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ABSTRACT 


When the DC Sniper shootings occurred in 2002, local law enforcement (LE) agencies in 
the National Capital Region (NCR) did not have a framework in place to investigate a 
large-scale multijurisdictional investigation involving dozens of federal, state, and local 
LE agencies. As of 2013, the NCR still does not have a framework. This thesis used 
multiple sources of infonnation and analysis to develop a list of recommendations 
directed to the NCR Police Chiefs Committee about how such a framework could be 
developed and what some of the features should be. The sources of information included 
lesson learned from the after-action analysis of the DC Sniper case by the Police 
Executive Research Forum, academic research on collaboration, the National Incident 
Management System, and input from 19 multijurisdictional and intergovernmental 
subject matter experts (SME) in the NCR, including SMEs from the LE, fire, fusion 
center, and public information disciplines. In February 2013, the NCR Police Chiefs 
Committee endorsed the recommendations and started the process to create a framework 
for managing a multijurisdictional investigation in the NCR. 
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EXECUTIVE SUMMARY 


The Problem 

When the D.C. Snipers conducted their rampage of shootings in the National 
Capital Region (NCR) in October of 2002, local law enforcement agencies did not have a 
framework in place in which to conduct a regional investigation for the murders and 
shootings that spanned seven jurisdictions in D.C. area. One of the ways in which the 
Federal Bureau of Investigation (FBI) and the Bureau of Alcohol, Tobacco, and Fireanns 
(ATF) assisted local law enforcement in the investigation was by establishing a Joint 
Operations Center that functioned as the hub and the template for conducting an 
investigation involving dozens of law enforcement agencies. This paper discusses how 
the NCR local law enforcement agencies can prepare to conduct regional investigations 
by developing a framework for that mission, and makes recommendations to the NCR 
Police Chiefs Committee for how that process should proceed. This is a capabilities- 
based approach to preparing NCR local law enforcement agencies to manage 
multijurisdictional investigations of any scale. 

The National Capital Region (NCR) 

The NCR consists of 18 jurisdictions in and around Washington, D.C., There are 
eight primary jurisdictions and another 10 municipalities within their parent counties in 
Northern Virginia and Maryland. Law enforcement is fragmented in the NCR because of 
jurisdictional boundaries with each of the major jurisdictions and most of the 
municipalities having full-service police departments. Additionally, the FBI and ATF 
divide responsibility for the NCR between two regional offices with the Baltimore Field 
Offices having jurisdiction over the Maryland counties and the Washington Field Offices 
having jurisdiction over Washington, D.C., and Northern Virginia. The state police 
agencies of Maryland and Virginia do not have primary investigative responsibilities for 
serious crimes occurring in the NCR outside of the interstate highways. Despite this 
jurisdictional fragmentation in law enforcement, the NCR does maintain a Police Chiefs 
Committee that has representation from federal, state, and local law enforcement 
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agencies. This committee provides a mechanism and focal point for collaboration 
between the various agencies and levels of government. 

Research to Help Develop a Framework 

To develop the framework for regional investigations, this paper examines 
information gleaned from: 

• Federal and regional documents and plans that promote collaboration in a 
capabilities-based preparedness environment; 

• Lessons-learned from the D.C. Sniper case outlined in the after action 
report titled Managing a Multijurisdictional Case which was published by 
the Police Executive Research Forum (PERF); 

• The National Incident Management System (NIMS); 

• Academic research on collaboration; and 

• A Delphi-survey conducted with 19 senior subject matter experts from 
several disciplines in the NCR. 

Some of the documents that provide bedrock of support for this paper focus on a 
regional approach to capabilities-based planning to fulfill the five homeland security 
missions of prevention, protection, response, mitigation, and recovery. They include: 

• The Homeland Security Presidential Directive - 5 that mandates the use of 
the National Incident Management System across all jurisdictions, levels 
of government, and private agencies for managing incident response. 

• Presidential Policy Directive 8 and the National Preparedness Goal that 
mandates a whole-community based approach to planning; and 

• The NCR Homeland Security Strategic Plan 2010. 

PERF was contracted by the United States Department of Justice to conduct an 
after action analysis of the D.C. Sniper investigation of 2002. PERF perfonned an 
extensive analysis of the investigation by interviewing many of those involved in the 
investigation, examining documents, and visiting facilities and locations of the crimes. It 
published its findings in the 2004 report Managing a Multijurisdictional Case. Key 
recommendations in the report focus on leadership, collaboration, the Joint Operations 
Center, managing information, employing an incident management system, and 
maintaining good communication. 
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To determine how the National Incident Management System could be used in the 
investigative framework, the writer compared and contrasted NIMS with the incident 
management model of the United Kingdom - the Gold-Silver-Bronze model. Both 
systems provide a perspective that can very useful to managing a regional investigation, 
especially these three elements of the Command and Management Component of NIMS: 
The Incident Command System (ICS), the Multiagency Coordination Group (MAC 
Group), and Public Information (Media). 

Since managing a regional investigation will require a great deal of collaboration 
on the part of many people and agencies, the writer examined academic research on 
collaboration to detennine what factors tended to foster or inhibit collaboration. These 
factors can be divided into three basic categories: 1) leadership; 2) structural 
foundations; and 3) technology. A successful collaborative endeavor must have 
leadership that does the things that foster collaboration and avoids doing those things that 
hinder collaboration. But leaders also need to function in an environment that promotes 
collaboration through policies, facilities, organizations, training, education, exercises, and 
other structural underpinnings. And finally, there must be the technology to facilitate 
effective communication and data management. 

To solicit support for developing an NCR framework for managing regional 
investigations, the writer conducted a Delphi survey of 19 senior subject matter experts 
(SMEs) from the NCR. Thirteen SMEs were from law enforcement and represented the 
two FBI offices servicing the NCR, the eight primary NCR jurisdictions, two 
municipalities, and incident command from the D.C. Sniper task force. The other six 
SMEs represented the disciplines of fire/EMS, public information officers, and the three 
fusion centers servicing the NCR. These SMEs furnished their professional opinions on 
how various law enforcement agencies and the other disciplines could work together to 
sustain a regional law enforcement investigation. There was considerable agreement 
between the academic research on collaboration and the SMEs’ insights on collaboration, 
as well as the value of using a standard incident management system such as NIMS to 
manage an investigation. Additionally, all of the SMEs embraced the concept of creating 
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a framework for conducting regional investigations and also using non-law enforcement 
disciplines to help support an investigation. 

Recommendations 

Based upon the support from federal and NCR preparedness planning documents, 
academic research, lessons learned from the D.C. Sniper investigation, and the NCR 
subject matter experts, this paper concludes with 10 recommendations to the NCR Police 
Chiefs Committee. The recommendations focus on creating an investigative 
subcommittee of the Police Chiefs Committee that will oversee the development of the 
investigative framework. The subcommittee should strongly consider input provided by 
the PERF report, the NCR SMEs, and the National Incident Management System. 
Furthermore, the subcommittee should identify technology requirements to support 
secure communication and data management, and make recommendations to the Police 
Chiefs Committee for grant investments. And finally, the subcommittee should create an 
education, training, and exercise plan to develop and validate the capabilities necessary 
for conducting an effective and efficient multijurisdictional investigation. 
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I. INTRODUCTION 


What if there was another round of murderous attacks in the National Capital 
Region (NCR) similar to the DC Sniper attacks in 2002; or if a serial rapist were 
terrorizing citizens, making them fearful of being either out in public or home alone; or if 
elderly residents in wealthy neighborhoods were living in anxiety because they were 
targeted for home invasion robberies by criminals who stalk the weak and defenseless? 
What if a Mumbai-style terrorist attack were to occur? Is the NCR law enforcement (LE) 
community prepared to coordinate an efficient and effective investigative response to 
shut down these serial criminals and bring them to justice? This paper will examine how 
the NCR can prepare to mount an intergovernmental, interagency, and multidisciplinary 
investigation of a series of crimes spanning multiple jurisdictions. 

A. PROBLEM STATEMENT 

When the DC Snipers commenced their shooting rampage in and around the 
National Capital Region (NCR) in October of 2002, the NCR local LE agencies were not 
prepared to conduct the type of intergovernmental and interagency investigation 
necessary for such a dynamic series of crimes spanning multiple jurisdictions. In a span 
of 19 days, 10 people were murdered and three others were wounded in five NCR 
jurisdictions and two other Virginia jurisdictions (Murphy & Wexler, 2004, pp. 7-12). 

Since Montgomery County, Maryland experienced the first five of the sniper 
murders in less than a 16-hour period, the Montgomery County Police (MCP) assumed 
the role of lead investigative agency (Murphy & Wexler, 2004, p. 20). As the shootings 
continued in other jurisdictions in and around the NCR, more than a thousand federal, 
state, and local law enforcement investigators joined in what may have been the largest 
multijurisdictional investigation in U.S. history (Murphy & Wexler, p. v). This influx of 
resources overwhelmed the ability of the MCP to manage such a large-scale investigation 
(Murphy & Wexler, pp. 42-43). The Bureau of Alcohol, Tobacco, and Firearms (ATF) 
and the Federal Bureau of Investigation (FBI) had experience recently during the 
investigations of the 9/11 terrorist attacks (2001) and the Oklahoma City terrorist 
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bombing (1995) of working within a federal Joint Operations Center (JOC), which 
provided a facility and a structure for managing large-scale investigations (Murphy & 
Wexler, p. 42). 

As a region of both national and international importance, the NCR is a target-rich 
environment for not only terrorist attacks but other high-profile non-terrorist pattern 
crimes such as murders, sexual assaults, and violent anned robberies. Currently, there are 
no regional models or guidelines for how the NCR will launch an integrated 
intergovernmental, interagency, and multidisciplinary investigative response to a series of 
crimes spanning multiple jurisdictions. While many NCR local LE agencies work 
together in task forces for street level crimes (e.g., gangs, drugs, firearms), they rarely 
work together on investigations that would require dozens, or even hundreds, of 
investigators as occurred during the DC Sniper case. There were many lessons-leamed 
during that investigation; however, the NCR has not developed an investigative model 
that incorporates those lessons-learned. 

The consequences of not having an investigative model in place could be 
detrimental to a multijurisdictional investigation and to any subsequent prosecution. 
There would likely be problems relating to investigative command, coordination, 
communication, and data-sharing between the different jurisdictions. This could lead to a 
host of investigative troubles, including inconsistent or duplicative effort, incomplete 
situational awareness, and confusing or erroneous public messaging. 

This issue merits further research to ensure that the full range of NCR resources 
from LE and other disciplines could be marshaled effectively and efficiently to mount a 
successful investigative response to a series of pattern crimes spanning multiple NCR 
jurisdictions. Creating an intergovernmental, interagency, and multidisciplinary 
investigative framework would enhance command, coordination, communication, and 
data-sharing between agencies. It would also facilitate a timely, efficient, and successful 
multijurisdictional investigative response. 
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B. RESEARCH QUESTION 


How can the National Capital Region (NCR) prepare for an integrated 
intergovernmental, interagency, and multidisciplinary investigative response to a critical 
series of crimes spanning multiple NCR jurisdictions? 

1. Sub-Questions 

1. How would the investigative response differ between crimes having a 
terrorism nexus and those that do not? 

2. How can “lessons-learned” from the DC Sniper investigation of 2002 be 
integrated into the investigative plan? 

3. How can the National Incident Management System (NIMS) be utilized to 
facilitate management of the investigation? 

4. How can lirc/EMS, fusion centers, and the public information disciplines 
be incorporated into the investigative plan? 

5. What are the challenges of integrating managerial, investigative, and 
multidisciplinary protocols involving 18 NCR local jurisdictions and the 
FBI? 

2. Context for Answering These Questions 

To lay a foundation for answering these questions, this chapter: 

• offers background information about the NCR to provide a context in 
which to understand the multijurisdictional landscape; 

• proposes central arguments that claim that the NCR law enforcement 
community (LE) can, and should, develop a local LE investigative 
framework for regional investigations; 

• examines the after action analysis of the DC Sniper investigation that 
provides valuable lessons-learned to incorporate into the plan; 

• suggests that the incident management models from the United States and 
the United Kingdom provide insight into formulating a management 
structure for an investigation; 

• contends that LE should leverage the resources of other disciplines to 
assist in an investigation; and that LE will need to develop protocols for 
how diverse agencies and disciplines will work together. 

This chapter also presents a literature review that discusses some of the research 
that will lay a solid groundwork for developing a successful plan. Additionally, to 
engender buy-in and support for a regional plan, the writer solicited opinions from key 
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NCR leaders / subject matter experts who would be operating within the parameters of 
this plan. The method used to glean these insights was the Delphi research method, which 
will be discussed later in this chapter. 

This research could lead to profitable outcomes not only for the NCR, but also for 
other areas in the United States seeking a model that incorporates LE operations and 
other available resources to ensure a successful conclusion to an investigation. The 
process of collaborative planning to integrate a wide array of response resources dovetails 
well with national preparedness goals outlined in documents such as the National 
Response Framework (U.S. Department of Homeland Security [DHS], 2008b), 
Presidential Policy Directive 8 (White House, 2011), the National Preparedness Goal 
(DHS, 2011), and Homeland Security Presidential Directives 5 (White House, 2003), 
among others. 

C. A NATIONAL CAPITAL REGION PRIMER 

The NCR is a federally recognized region comprised of 18 jurisdictions that 
include Washington, D.C., and the surrounding counties and incorporated cities from 
Maryland and Virginia (United State Code, Title 40). There are eight major jurisdictions, 
while the remaining ten jurisdictions are incorporated cities within parent counties 
(MWCOG HLS Strategic Plan, 2010) (see Figure 1). The Washington, D.C., and the 
Maryland counties are geographically separated from the northern Virginia jurisdictions 
by the Potomac River. With 2,500 square miles and a population of over five million, the 
NCR is the fourth largest metropolitan area in the country (Federal Emergency 
Management Agency [FEMA], 2011). 
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Figure 1. The National Capital Region (From FEMA, 2012) 


There is no central government in the region, but rather each jurisdiction 
maintains its own independence; however, in many respects, the region is fairly well- 
organized because of the role played by the Washington Metropolitan Council of 
Governments (COG or MWCOG) which facilitates the coordination of many 
governmental functions in the region (MWCOG, 2010, p. B2-10). COG supports 15 
regional emergency support functions (R-ESFs) that pursue preparedness activities for 
public safety planning and response actions, including the Police Chiefs Committee, the 
Fire Chiefs Committee, and the External Affairs Committee (MWCOG, 2010, p. B5-7). 
The NCR has generated many regional planning documents including the Regional 
Emergency Coordination Plan (MWCOG, 2002) and a Homeland Security Strategic 
Plan, (MWCOG, 2010). 

LE is fragmented in the region as each of the 18 NCR jurisdictions and other non¬ 
incorporated towns maintains its own LE agency, while two FBI field offices divide 
responsibilities in the region (Federal Bureau of Investigation [FBI, n.d.]). 


5 



D. ARGUMENTS 


1. Local LE Multijurisdictional Investigative Model 

Rather than depending on federal law enforcement agencies to provide the 
structure and resources to manage a series of pattern crimes spanning multiple NCR 
jurisdictions, the NCR local LE agencies should develop a plan and the capabilities 
necessary for managing such investigations. 

One of the crucial issues is to identify the differences in an investigation that has a 
terrorism nexus and one that does not. The National Response Framework (NRF) (DHS, 
2008b) has identified the Department of Justice (DOJ) as the lead investigative entity for 
terrorism incidents, and the DOJ has assigned that responsibility to the FBI (U.S. DHS, 
2008) p. TER-2). Because the FBI has its own protocols for managing terrorism 
investigations, if local LE were to support an FBI terrorism investigations, local LE 
would have to follow the FBI investigative model. If a multijurisdictional series of crimes 
did not have a nexus to terrorism, then the local LE agencies would most likely be the 
lead investigative agencies and would need a model or guidelines to help them integrate 
the investigation. Although local LE may be the investigative lead, federal LE in the 
NCR has a history of providing generous support to augment local investigative 
capabilities without assuming the management of the investigation. For the investigation 
of pattern crimes spanning multiple NCR jurisdictions, it is imperative to determine 
whether a federal LE agency is the lead agency or a support agency; a detennination that 
is sometimes hard to make because the line between terrorism and other crimes is 
sometimes blurred. The expectations that federal and local LE agencies will have of each 
other will be different depending on who is the lead investigative agency. 

2. Learning from History 

The DOJ contracted with the Police Executive Research Forum (PERF) to 
conduct an after-action analysis of the DC Sniper investigation. The report Managing a 
Multijurisdictional Case (Murphy & Wexler, 2004) proffered dozens of conclusions and 
lessons-leamed from the investigation. The report addressed the issues of leadership, 
federal LE resources, managing investigations, information management, local LE 
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operations, the media, and the community. Although the report made recommendations 
for how the NCR could conduct a similar investigation in the future (Murphy & Wexler, 
2004), NCR local LE agencies have not adopted the recommendations. One of the 
possible reasons for this could be that there has not been a champion to shepherd these 
recommendations through the process of becoming a regional investigative model. This 
research project is intended as a step towards making that happen; however, it will 
require the time, effort, input, and buy-in of key LE managers, supervisors, and 
investigators from many agencies. 

3. Incident Management 

Homeland Security Presidential Directive-5 (HSPD-5) mandates that the National 
Incident Management System (NIMS) be used as the comprehensive approach to incident 
management (White House, 2003, p. 1). The objective is “to ensure that all levels of 
government across the Nation have the capability to work efficiently and effectively 
together, using a national approach to domestic incident management” (White House, 
2003, p. 1). One of the goals of NIMS is to provide a vehicle for different agencies to 
seamlessly integrate their response operations (White House, 2003, pp. 1-2). While LE 
officers may have been trained to the requisite levels of NIMS, there is oftentimes a 
disconnection between the training and the use of NIMS. The consequences of this 
disconnection is that when LE needs NIMS to manage a large-scale incident or 
investigation, LE personnel may not have the necessary comfort level with NIMS to use 
it effectively. Because LE leaders know beforehand that certain things will have to be 
done in a multijurisdictional investigation, an investigative NIMS-compliant framework 
could be developed beforehand, just as an agency would do for any preplanned event. 
The structure should promote the NIMS concepts of the Incident Command System 
(ICS), Multiagency Coordination System, and the Joint Infonnation System. Preplanning 
will help formulate an investigative model or guidelines in a time of calm rather than in 
the middle of a dynamic or deadly series of crimes. 

The DC Sniper investigation concluded prior to the issuance of HSPD-5 and did 
not directly follow the precepts of NIMS; however, when superimposing the joint 
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operations center (JOC) model over the NIMS model, one can see many commonalities 
between the two management systems. The NIMS model provides a significant level of 
functionality for managing an incident or investigation; however, many people find the 
system too complicated to understand or retain without regular use. The United 
Kingdom’s (UK) Gold-Silver-Bronze incident management model is a simpler model to 
understand but lacks the robust functionality of the NIMS model. Incorporating some of 
the simple verbiage of the UK’s model into the NIMS incident management model would 
help provide a more meaningful concept of operations to those who do not require a full 
understanding of NIMS/ICS to perfonn their response duties within the system. 

4. Joint versus Networked Investigations 

The traditional LE model of conducting a joint investigation or task force is to 
manage the investigation out of a single command post or joint operations center (JOC). 
JOCs are typically ad hoc locations established to manage intergovernmental and/or 
interagency investigations. They bring all the relevant stakeholders together to work side- 
by-side, but they can be expensive to stand-up and maintain. In addition, they can reduce 
the efficiency of personnel who have to travel long distances to work in them. For some 
investigations, a JOC may continue to be the best option to manage the cases. For other 
regional investigations, a network of command posts may be a better option. The network 
of command posts means that managers, supervisors, and investigators from different 
agencies would manage and investigate the cases from their usual work locations; 
however, they would communicate, coordinate, and share data with each other using 
technology. This technology would include data-sharing mechanisms in which 
investigators would share a common case file and audio/video communications, such as 
conference calls or video teleconferencing (VTC). There are advantages and 
disadvantages with both the JOC and network of command posts models, but each may 
have a role depending on the nature of the regional investigation. 

The NCR is an organized and resource-rich region as will be demonstrated in the 
next chapter. For a multijurisdictional investigation, FE should recruit other disciplines to 
help accomplish its goals. The NCR is served by three fusion centers (D.C., Maryland, 
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and northern Virginia), many fire departments, and public information officers in all 
jurisdictions. A challenge for LE is to recognize the utility of the capabilities of other 
disciplines and then incorporate those disciplines into the regional investigative plan. 

5. Regional Investigative Protocols 

Each LE agency has protocols for how to conduct investigations. If the FBI were 
the lead investigative agency, would there be just one set of investigative protocols for all 
involved agencies? If NCR local LE were the lead agencies, should there be one set of 
common protocols? The answer to these questions mirrors the answer to a previous 
question that recognizes the need to detennine whether the lead agency is federal or local 
LE. Since the FBI is a national organization whose cases are prosecuted in the U.S. 
federal courts by federal prosecutors, its investigative protocols are mostly standard from 
one field office to another. The FBI would require local LE to follow the FBI’s protocols 
when assisting an FBI investigation. 

If NCR local LE agencies are the lead agencies, it is unlikely that there would be 
common investigative protocols since there are too many local agencies that would have 
to synchronize their procedures. State, county, and municipal laws may differ from 
jurisdiction to jurisdiction, which might prevent the coordination of policies and 
procedures. If local LE agencies are successfully prosecuting cases using their own 
protocols, is there a need to change them to fit a common NCR protocol? 

It seems unnecessary and impracticable to modify an agency’s investigative 
protocols to fit a regional model; however, there should be common protocols for how 
agencies will work together during a joint investigation (e.g., command structure, 
problem resolution, data-sharing, communication, and coordination activities). These 
tasks are not accomplished in isolation but rather jointly by multiple agencies; therefore, 
regional protocols defining working relationships are necessary for effectiveness and 
efficiency. 
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E. LITERATURE REVIEW 

1. National Capital Region 

There are quite a number of references in the literature concerning the National 
Capital Region. These references describe the jurisdictional components of the region and 
report on the region’s population, economic, and governmental data. Within the NCR, 
there is another regional entity called the Metropolitan Washington Council of 
Governments (MWCOG, aka COG), which is a regional non-governmental independent 
non-profit organization fonned in 1957 to facilitate regional planning in the D.C. area. 
Since then, COG has evolved into a much larger structure that forms the latticework for 
how the NCR conducts preparedness activities within the scope of the National Response 
Framework (DHS, 2008b). The NCR and COG jurisdictions overlap, except that COG 
has two additional Maryland counties and two additional municipalities. There is ample 
data online and in the literature describing both the NCR and COG. 

2. NCR Documents 

The NCR released its latest Homeland Security Strategic Plan in 2010 (MWCOG, 
2010), which outlines its plan for achieving priority capabilities over the next three to 
five years. Priorities include regional collaboration for planning and decision making for 
activities relating to all-hazards preparedness for the four homeland security missions in 
effect at the time of publishing: to prevent, protect against, respond to, and recover from 
all hazard incidents (MWGOG, 2010). Fundamental goals include (MWCOG, 2010a): 

• enhancing regional capabilities for fashioning interoperable 

communications for voice, data, and video (p.7); 

• identifying essential elements of data within each discipline that should be 
shared, and then developing business practices and communications 
technical standards to maintain situational awareness (p.8); and 

• ensuring that NCR fusions centers share data in both secure and non- 
secure systems (p.9). 

In addition, the plan recognizes that the Regional Emergency Support Functions 
(R-ESFs) are responsible for identifying preparedness gaps and notifying appropriate 
NCR leadership committees of the need for grant funds and other resources to close those 
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gaps (MWGOG, 2010b, p. B5). This document provides the underlying support for this 
paper that seeks to craft guidelines for command, communication, coordination, and 
information-sharing in a regional LE investigation. 

Another plan used is the NCR Regional Emergency Coordination Plan (RECP) is 
a plan to enhance regional communications and coordination during a disaster or 
emergency (MWCOG Task Force on Homeland Security and Emergency Preparedness 
for the National Capital Region, 2002, p. 1). The Regional Incident Communications and 
Coordination System (RICCS) as one of the linchpins of the plan, and is a system of text 
messages, conference calls, and Web-communication that facilitates situational 
awareness and coordination within and between R-ESFs after major incidents or 
emergencies (MWCOG Task Force on Homeland Security and Emergency Preparedness 
for the National Capital Region, 2002, p. 2). RICCS may be a good way to initiate a 
coordinated investigation; however, RICCS is not designed for the long-term 
communication needs of an extended regional investigation. No such long-term regional 
communication, coordination, and information-sharing system exits in the NCR for 
managing a complex investigation. This paper will address this issue. 

3. Fusion Centers 

Three fusion centers serve the NCR: 

1. Maryland Coordination and Analysis Center (MCAC); 

2. the Washington Regional Threat Analysis Center (WRTAC); and 

3. the Northern Virginia Regional Intelligence Center (RIC). 

There is some information about MCAC on its website; however, the various 
intelligence products produced by these centers form the body of literature about those 
centers. 

The National Incident Management System recognizes the importance of the 
intelligence/investigation function and places it within the ICS model in a variety of 
ways. However, there is virtually no literature on how fusion centers can assist in a 
multijurisdictional investigation beyond their usual attempt at “connecting the dots” from 
multiple sources of information. Fusion centers have resources that can assist 
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investigators in conducting routine investigative functions normally perfonned by 
detectives (e.g., perfonning background checks on a multitude of suspects, gathering and 
analyzing infonnation from a variety of R-ESF functions involved in the investigation, 
and disseminating for official use only-law enforcement sensitive (FOUO-LES) 
infonnation to a wide EE audience). This paper may help to break new ground in the 
utility of fusion centers in support of regional investigations. 


4. Successful Collaboration 


There have been numerous theses written by students in the Center for Homeland 
Defense and Security (CHDS) master’s program addressing the issue of interagency and 
inter-discipline collaboration, drawing upon the body of literature in business, academia, 
and government. Some original research has also been conducted by staff researchers at 
the Naval Postgraduate School in Monterey, California. This and other academic research 
tends to be consistent in describing those factors that foster or hinder collaboration. 

In 2004, the Police Executive Research Forum published its after-action analysis 
of the 2002 DC Sniper investigation. The report was created after extensive interviews 
with key personnel and focus groups (of which the writer was a member) involved in the 
investigation. The report noted conclusions and recommendations in a number of areas, 
including collaboration, communication, command, task forces, command posts, 
technology, roles and responsibilities, leadership, and the use of federal resources. 


Much of the literature on collaboration provides a consistent perspective on what 
factors help or hinder collaboration. These factors can be grouped into three basic areas: 

1. leadership skills; 

2. technology; and 

3. structural or institutional support. 


a. Leadership Skills 

Not surprisingly, the personal skills, traits, and attitudes that were 
identified as fostering collaboration were those dealing with power-sharing, trust, 
motivation, flexibility, communication, consensus decision making, information-sharing, 
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building social capital, having team pride, taking ownership of outcomes, and the 
perceived need to collaborate. 

b. Technology 

The right technology used in the right manner also facilitates 
collaboration. Technology that promotes infonnation-sharing and is interoperable, 
scalable, flexible, adaptable, secure, and affordable is the kind of technology that will 
foster a more collaborative working environment. However, technology by itself, without 
the requisite leadership skills and structural support, is not sufficient to maintain a 
collaborative environment. 

c. Structural Support 

The kind of structural support that promotes successful collaboration is 
centered in planning, training, funding, and working in collaborative events. Planning 
includes those activities that support NIMS, the National Response Framework, strategic 
planning, regional communications planning, a clear purpose and mission, and the 
establishment of formal and mandated systems for roles and responsibilities. Training 
activities are those that provide instruction on leadership, technology, and structural 
support processes. Collaborative events include real-world incidents, social meetings, 
training, and multidisciplinary exercises. Funding , especially from federal grants, is 
necessary to support all of the above activities. 

There was nothing controversial in the literature about collaboration; 
however, the literature did provide information about factors that promote and hinder 
collaboration, which will be used to lay a foundation in this paper for fostering successful 
collaborative processes. 

5. Incident Command 

a. National Incident Management System (NIMS) 

According to HSPD-5 and NIMS, NIMS is the prescribed system for 
managing emergency incidents and preplanned events in the United States (White House, 
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2003, p. 1) (DHS, 2008a, p. 3). The Department of Homeland Security’s 2008 National 
Incident Management System (NIMS) outlines the tenets of NIMS, and there are a 
number of FEMA-sponsored online and classroom NIMS training programs (e.g., IS-100, 
IS-700, ICS-200, ICS-300, ICS-400). There are articles supporting the usefulness of 
NIMS, but there was no apparent documentation for how NIMS has been used 
specifically to coordinate regional LE investigations. The FBI investigative management 
model does not follow the NIMS model; however, that is not a concern in this paper. 

b. Gold-Silver-Bronze 

The incident management system used in the United Kingdom (UK) is 
called the “Gold-Silver-Bronze.” This model is outlined in various documents issued by 
the UK central government and incorporated into inter-disciplinary emergency response 
plans for disaster response agencies in London Examples include: (1) Emergency 
Response and Recovery (HM Government of the United Kingdom, 2010); (2) Responding 
to Emergencies: The UK Central Government Response Concept of Operations (Cabinet 
Office, 2010); and (3) Major Incident Procedure Manual (London Emergency Services 
Liaison Panel, 2007). 

Both the NIMS and Gold-Silver-Bronze incident management models 
have strengths and weaknesses. An analysis of the literature shows that the weaknesses 
contained in each model can be bolstered by substituting its key counterpart from the 
other model. Analyzing the strengths of each model can be very useful in fonnulating a 
regional investigative incident management model. 

F. METHOD 

1. Delphi Survey 

The Delphi method of research uses subject matter experts (SMEs) to provide 
expert opinions on issues that lend themselves to subjective expert judgment when 
available infonnation is limited. Among other purposes, the Delphi method is used to 
explore planning options relating to interagency collaboration, which is the central theme 
of this paper. The characteristics of the Delphi method are: 
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1. it uses an iterative process of multi-round surveys to facilitate 
communication among an anonymous group of subject matter experts 
(SMEs) around a complex problem; 

2. it elicits opinions from SMEs; and 

3. the anonymity afforded to the SMEs allows them to voice their opinions 
more fully and openly (Rowe & Wright, 1999, p. 354). 

The input provided by the SMEs can foster buy-in from the involved agencies and 
disciplines for the recommendations emanating from the research. 

The first round of interviews often uses a structured set of questions. After 
obtaining input from the SMEs, the researcher identifies similar themes espoused by the 
SMEs. The researcher then develops a questionnaire for a second round of interviews that 
should build upon the responses from the first round. This process continues until a 
consensus is reached by the Delphi panel. Three rounds of interviews are typical for a 
Delphi study but more can be conducted, if necessary. 

The Delphi method was used to conduct the research for this paper since it would 
allow for solicitation of input from key SME stakeholders in multiple NCR jurisdictions 
and disciplines, and it would thereby engender a higher level of buy-in from those 
agencies. The writer used the input provided by these SMEs, along with information from 
other sources and his own analysis, to craft recommendations for conducting regional LE 
investigations that would likely have a broad range of support in the NCR. 

The writer chose 13 of the 19 Delphi Panel members from local and federal LE 
agencies because of the law-enforcement-centric nature of this research. He chose not to 
include SMEs from state police agencies because they do not have primary investigative 
responsibilities within the Maryland and Virginia NCR jurisdictions; however, the state 
police agencies do have significant representation in the northern Virginia and Maryland 
fusion centers. Since three state and local fusion centers serve the NCR, the writer 
allotted one representative from each center to serve on the Delphi panel. The writer 
allotted two representatives from fire/EMS and one representative from the public 
information functions. 
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To identify appropriate members of the Delphi panel who could speak for their 
agencies and/or discipline, the writer solicited SME recommendations from the 
chairpersons of the primary NCR committees representing LE (R-ESF #13 Police Chiefs 
Committee), lirc/EMS (R-ESF #4 Fire Chiefs Committee), and public infonnation (R- 
ESF #15 External Affairs Committee). To represent the three fusion centers, the writer 
solicited similar recommendations from the director or deputy director of each center. 

The chair of the Fire Chiefs Committee recommended two senior fire/EMS chief 
officers from two major NCR fire departments. The chair of the External Affairs 
Committee recommended a public infonnation officer (PIO) serving as the senior PIO in 
a major NCR jurisdiction. In addition, the directors of the three fusion centers each 
recommended senior officials from their agencies to represent their discipline. Finally, 
the Police Chiefs Committee decided that each NCR LE agency would make its own 
recommendations for who should represent the individual departments. 

Since there are many federal and local LE agencies in the NCR, for practical 
reasons, the writer limited the number of SMEs that would represent the LE discipline on 
the Delphi panel. Since the FBI is the lead federal agency for terrorism investigations and 
routinely provides support to NCR local LE, the writer solicited recommendations from 
senior FBI personnel from each of the two FBI field offices that serve the NCR: the 
Baltimore Field Office (BFO) and Washington Field Office (WFO). The writer followed 
the same procedure for the primary LE agencies representing the eight major NCR 
jurisdictions. To obtain the perspective and input from smaller local LE agencies, the 
writer chose two police departments from a municipality and a town located within a 
primary NCR jurisdiction. And finally, the writer solicited the participation of one of the 
incident commanders who led the investigative response in the DC Sniper case. 

All of the recommended SMEs agreed to participate in the Delphi panel. Their 
identities have been kept confidential, even to each other. The Delphi panel consisted of 
19 SMEs representing the following agencies and disciplines: 

Eight representatives from the primary LE agencies of the eight major NCR 
jurisdictions: 
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• Metropolitan Police Department (DC) 

• Alexandria Police Department (VA) 

• Arlington County Police Department (VA) 

• Fairfax County Police Department (VA) 

• Loudoun County Sheriffs Office (VA) 

• Prince William County Police Department (VA) 

• Montgomery County Police Department (MD) 

• Prince George’s County Police Department (MD) 

Two representatives from a municipal and a township police department: 

• Takoma Park Police Department (MD, located within Montgomery 
County) 

• Leesburg Police Department (VA, located within Loudoun County) 

Two Federal Bureau of Investigation (2 offices): 

• Baltimore Field Office (Covers Montgomery and Prince George’s 
Counties) 

• Washington Field Office (Covers D.C. and northern Virginia jurisdictions) 
Three representatives from the three fusion centers serving the NCR: 

• Maryland Coordination and Analysis Center (MD) 

• Washington Regional Threat Analysis Center (DC) 

• Northern Virginia Regional Intelligence Center (VA) 

Two fire/EMS representatives from two jurisdictions: 

• Montgomery County Fire and Rescue Services 

• District of Columbia Fire Department 

One public information officer (The name of the specific jurisdiction is being 
withheld to maintain the confidentiality of this SME.) 

One Retired LE executive officer who served as an investigative incident 
commander during the DC Sniper case investigation. 

For the first round, the writer interviewed each of the Delphi panel members at 

his/her place of employment or home using a standard questionnaire that had been 

emailed to them several days prior to the interview. (See the appendix for a list of the 

Delphi panel questions.) The writer audio recorded the interviews and transcribed the 
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audio into typewritten notes. After the first round was completed, the writer identified 
themes common to most of the SMEs. These themes centered on things the SMEs 
thought promote or hinder collaboration and trust, incident management, joint operations 
centers (JOC) and networks, information-sharing technology, and the integration of other 
disciplines into the investigative model. Because the SMEs were in such close agreement 
on the primary themes of the research after the first interview, it became apparent that a 
second and much shorter interview would complete the Delphi research process. 

The writer compiled a list of the common themes and all other comments made by 
the SMEs in a Word document table. There were 189 separate comments listed that 
ranged from a comment made by just one SME to comments made by all the SMEs. 
Adjacent to each comment, the writer listed the number of SMEs who had made a similar 
comment (e.g., “one,” “some,” “many,” “most,” and “all”). The writer emailed these 
tables to the SMEs and asked them to review each of the comments and determine if they 
“agree,” “disagree,” or are “undecided,” about the comment. Some of the SMEs emailed 
the tables back to the writer with their responses while others gave the writer their input 
in a telephone interview. A third round of interviews was not necessary because 
consensus on the fundamental issues had been achieved by the end of the first round of 
interviews, while the second round provided some additional insight into the central 
themes. 

The subject matter experts of the Delphi panel provided valuable input relating to 
the central issues involved in planning for a regional investigation. There was a high level 
of agreement between federal and local LE agencies and between the four disciplines 
represented in the panel. The LE SMEs were in agreement about the need to create a plan 
for regional investigations, as well as some general recommendations for an investigative 
framework. The non-LE SMEs provided insight into how their disciplines could support 
an investigation. 

G. SIGNIFICANCE OF RESEARCH 

This research examines some of the foremost issues relating to multiple agencies 
and disciplines working collaboratively on an investigation. These issues are: 
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1. identifying those things that foster and hinder collaboration; 

2. identifying how the investigation will be managed; 

3. identifying when the investigation will be managed from a JOC vs. a 
network of command posts; 

4. identifying the type of technology that will support a network 
investigation; and 

5. identifying how other disciplines can assist in a LE investigation. 

There are existing templates to assist in constructing this investigative model. The 
Police Executive Research Forum PERF report contains many reasonable lessons-leamed 
and recommendations that can be incorporated into the NCR investigative framework 
(Murphy & Wexler, 2004). Furthermore, NIMS and the UK’s incident management 
models are systems for managing all-hazards responses. The challenge will be to 
demonstrate how these can be integrated to establish a preplanned investigative 
organizational framework to manage a regional investigation. 

1. To the Literature 

Pattern crimes spanning multiple jurisdictions are common problems for LE (e.g., 
commercial burglaries and anned robberies, sexual offenses, auto thefts, burglaries of 
wealthy residential neighborhoods, and occasionally murders). Incidents such as the DC 
Sniper case are an infrequent occurrence, but they have a high impact regionally. This 
paper will help to fill in the gaps in the literature for coordination of regional 
investigations by applying the lessons-learned from the DC Sniper investigation, using 
the NIMS/ICS model as applied to the management of regional investigations, and 
incorporating other non-LE emergency support functions into a regional LE 
investigation. 

2. To Future Research Efforts 

This paper could spawn additional research into shaping specific command, 
communication, coordination, and data-sharing protocols for a multijurisdictional LE 
investigation in the NCR. Conducting an investigation in a network of command posts 
model rather than in a single joint operations center poses significant communication and 
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coordination technology challenges. The merits of each model could be analyzed in an 
after-action review of regional investigations using the different models. 

3. To the National Capital Region 

By creating a framework for regional investigations and using the model to 
conduct the investigation of less-serious crimes, local LE will be better prepared to mount 
an effective investigative response to critical regional crimes like the DC Sniper case. It 
is helpful if regional partners understand the capabilities of all the partners and the 
expectations between agencies and different levels of government. Mutual aid 
agreements (MAAs) and/or memoranda of understanding (MOUs) are sometimes used to 
communicate these capabilities and expectations. 

This paper will provide the R-ESF #13 Police Chiefs Committee with specific 
planning recommendations for developing a framework for conducting regional 
investigations. These recommendations are in alignment with NCR priority goals as 
outlined in the NCR Homeland Security Strategic Plan 2010, and with a variety of 
federal and regional documents that emphasize the need to work in collaboration to 
address common problems. 

4. Homeland Security Practitioners and Leaders Nationally 

This paper may serve as a guiding light for how other jurisdictions can plan for 
collaborative regional LE investigations. It may prompt LE leaders to consider leveraging 
the capabilities of other disciplines to assist in the investigation and using NIMS to 
manage a large number of investigative resources from multiple agencies. 

5. Preparedness Concepts from the Department of Homeland Security 
(DHS) 

Since this paper addresses intergovernmental and interagency investigative 
response preparedness activities, it is important that these actions take place within the 
context of the preparedness guidelines and framework established by Presidential Policy 
Directive 8 (White House, 2011) and the National Response Framework (DHS, 2008b). 
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a. Presidential Policy Directive 8 (PPD-8) 

In 2011, President Barack Obama issued PPD-8 to strengthen 
preparedness activities in the United States to address risks associated with the most 
serious threats to the country (White House, 2011, p. 1). The document defines national 
preparedness as, “The actions taken to plan, organize, equip, train, and exercise to build 
and sustain the capabilities to prevent, protect against, mitigate the effects of, respond to, 
and recover from those threats that pose the greatest risk to the security of the Nation 
(White House, 2011, p. 5).” There are three main components associated with the 
implementation of PPD-8: 1): the national preparedness goal; 2) core capabilities; and 3) 
a national preparedness system (White House, 2011, p. 1). 

The National Preparedness Goal defines the goal as, “A secure and 
resilient nation with capabilities required across the whole community to prevent, protect 
against, mitigate, respond to, and recover from the threats and hazards that pose the 
greatest risk” (DHS, 2011, p. 1). As with Homeland Security Presidential Directive 8, 
issued in 2003, PPD-8 emphasizes a capabilities-based planning approach (White House, 
2011, p. 1-2). There are 35 core capabilities that support the five homeland security 
missions of prevention, protection, mitigation, response, and recovery (DHS, 2011, p. 2). 
The core capabilities build upon and replace the 37 capabilities listed in the target 
capabilities list, which was established during the George W. Bush administration (DHS, 
2011, p. 3), and will evolve with time as new challenges arise (DHS, 2011, p. 1). The 
NCR must develop the following core capabilities to support successful regional 
investigations: 

• Operational Coordination : “Establishes and maintains a unified and 
coordinated operational structure and process that appropriately integrates 
all critical stakeholders and supports the execution of Core Capabilities.” 
(DHS, 2011, p. 5) 

• Public Information and Warning : “Deliver coordinated, prompt, reliable, 
and actionable information to the whole community through the use of 
clear, consistent, accessible, and culturally and linguistically appropriate 
methods to effectively relay information regarding any threat or hazard, as 
well as the actions being taken and the assistance being made available, as 
appropriate.” (DHS, 2011, p. 5) 
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• Intelligence and Information-sharing : “Provide timely, accurate, and 
actionable information resulting from the planning, direction, collection, 
exploitation, processing, analysis, production, dissemination, evaluation, 
and feedback of available infonnation concerning threats to the United 
States, its people, property, or interests; the development, proliferation, or 
use of WMDs; or any other matter bearing on the U.S. national or 
homeland security by Federal, state, local, and other stakeholders. 
Infonnation-sharing is the ability to exchange intelligence, infonnation, 
data, or knowledge among Federal, state, local, or private sector entities, 
as appropriate.” (DHS, 2011, p. 6) 

• Planning : “Conduct a systematic process engaging the whole community 
as appropriate in the development of executable strategic, operational, 
and/or community-based approaches to meet defined objectives.” (DHS, 
2011, p. 5) 

• Operational Communications : “Ensure the capacity for timely 

communications in support of security, situational awareness, and 
operations by any and all means available, among and between affected 
communities in the impact area and all response forces.” (DHS, 2011, p. 
14) 

• Situational Assessment : “Provide all decision makers with decision¬ 
relevant information regarding the nature and extent of the hazard, any 
cascading effects, and the status of the response.” (DHS, 2011, p. 15) 

According to the Department of Homeland Security, “The National 

Response Framework (NRF) is a guide for how the nation will conduct all-hazards 

response” (DHS, 2008b, p. i). The NRF is organized into five main sections: 1) Core 

document; 2) Emergency Support Function Annex; 3) Support Annexes; 4) Incident 

Annexes; and 5) Partner Guides (DHS, 2008b, p. 3-4). The National Incident 

Management System (NIMS) is a companion document that presents standardized 

management tools as a national template for response actions (DHS, 2008b, p. 4). 

The NRF core document strongly supports the development of a regional 
investigative plan by stressing that senior leaders should build the basis for an effective 
response and should organize and integrate their capabilities with regional partners (DHS, 
2008b, p. 5). Five essential principles of the response doctrine outlined in the NRF core 
plan are: 

1. engaged partnerships; 

2. tiered response; 
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3. scalable, flexible, and adaptable operational capabilities; 

4. unity of effort through unified command; and 

5. a readiness to act (DHS, 2008b, p. 8). 

Planning for constructing a regional investigative model should 
incorporate these five fundamental NRF principles. Since engaged partnerships are vital 
to preparedness, preparedness activities should be coordinated both within jurisdictions 
and regionally (DHS, 2008b, p. 9). Incidents must be managed at the lowest jurisdictional 
level possible; however, when additional assistance is required, it should be a tiered 
response that may include neighboring jurisdictions, the state, and the federal government 
(DHS, 2008b, p. 10). The scope of an incident will determine the appropriate response 
level (DHS, 2008b, p. 10). Plans must be flexible and scalable to meet the response 
requirements that will be partially determined by the type and number of incidents, the 
gravity of the incidents, and the geographical magnitude of the incidents (DHS, 2008b, p. 
10). Unity of effort through unified command is crucial to response activities; therefore, 
leaders should employ the Incident Command System (ICS) to manage a 
multijurisdictional or multiagency incident (DHS, 2008b, p. 10). A readiness to act 
depends on the ability to communicate and the processes, procedures, and systems to 
support it (DHS, 2008b, pp. 10-11). 



The Preparedness Cycle Builds Capabilities 
Figure 2. The Preparedness Cycle (From DHS, 2008b, p. 27) 
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The NRF recognizes that a strong commitment to preparedness is essential 
for an effective response. The NRF promotes a preparedness cycle that includes (DHS, 
2008b): 

• Developing detailed and robust plans that define decision making 
procedures and leadership roles and responsibilities, among other things 
(P- 28); 

• Organizational structures and a management system to manage the 
response (p. 29); 

• Training to support operations (p. 31); 

• Securing the proper equipment and technology necessary for an effective 
response (p. 29); 

• Planning, conducting, and evaluating multijurisdictional and 

multidisciplinary exercises to validate the planning, systems, training, and 
equipment (p. 31); and 

• Establishing an evaluation and improvement planning process that 
incorporates lessons-learned back into the planning process (p. 32). 

The Emergency Support Function (ESF) Annex describes the role of ESFs 

as providing: 

... the structure for coordinating Federal interagency support for a Federal 
response to an incident. They are mechanisms for grouping functions most 
frequently used to provide Federal support to States and Federal-to- 
Federal support, both for declared disasters and emergencies under the 
Stafford Act and for non-Stafford Act incidents (DHS, 2008c, p. i). The 
Regional Emergency Support Function (R-ESF) structure of the NCR as 
described in the NCR Homeland Security Strategic Plan Appendices 
closely reflects the federal ESF structure (Metropolitan Washington 
Council of Governments. [MWCOG], 2010b, pp. B5-7) 

One of the NRF incident annexes is the Terrorism Incident Law 
Enforcement and Investigation Annex (DHS, 2008c). This annex identifies the FBI as 
being the lead agency for criminal investigation of terrorism incidents, and it describes 
the concept of the federal joint operations center as the structure to manage the incident 
(DHS, 2008c, p. TER3-14). 

The recommendations for generating a regional investigative model listed 
in Chapter VIII dovetail closely with national readiness priorities by focusing on 
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enhancing capabilities consistent with DHS’s core capabilities, operating within the 
guidelines of the NRF, and supporting both regional and national priorities. 

This chapter has identified the problem of not having a framework for 
regional local law enforcement investigations in the National Capital Region and some of 
the principal questions that need to be answered to create a useful model. The FBI 
already has a model for such investigations at the federal level; however, local LE 
agencies need to design their own model to ensure that a regional investigation conducted 
by local LE is done in an efficient and effective manner. There is a plethora of 
information in the literature relating to collaboration, leadership, national management 
models, and lessons-leamed from other multijurisdictional and intergovernmental 
investigations, especially the DC Sniper case of 2002. 

Since it is important that NCR personnel working within a 
multijurisdictional investigation understand the issues involved in crafting a suitable 
investigative model and have a stake in designing such a model, the primary research in 
this paper utilizes a Delphi survey of key NCR SMEs from several disciplines that would 
ultimately function within the model. The creation of a regional investigative framework 
dovetails nicely with the U.S. Department of Homeland Security’s emphasis on 
preparedness, enhancing capabilities, and using NIMS. The significance of this research 
could be pivotal not only the NCR but also for other regions in the country that may need 
regional investigative solutions. This chapter has provided some insight into the structure 
and ongoing collaborative efforts of the National Capital Region; however, the next 
chapter will more thoroughly examine how the NCR is both a fragmented, yet unified 
region. 
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II. THE NATIONAL CAPITAL REGION 


The National Capital Region is a unique region for both national and international 
reasons. Politically, it not only houses the three branches of the national government, but 
it also wields influence worldwide. Natural or manmade catastrophes (e.g., the DC Sniper 
case) could not only have a significant and cascading impact on the region but also on the 
national and international fronts. The region is comprised of many jurisdictions from two 
states and the District of Columbia. There are forces that unify the region, but there are 
also forces that divide the region. This chapter will examine some of these forces and 
demonstrate that while there are structural divisions within the NCR, there are also 
unifying configurations that make collaboration on crafting a regional investigative 
framework not only possible but desirable. 
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Figure 3. The National Capital Region (From FEMA, 2012) 
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The National Capital Region (NCR) was created by the National Capital 
Planning Act of 1952, 40 USC 71 and is a federally recognized region comprised of 18 
jurisdictions that include Washington, D.C., and the surrounding counties and 
incorporated cities from Maryland and Virginia (FEMA, 2012). There are eight major 
jurisdictions, while the remaining 10 jurisdictions are incorporated cities within parent 
counties (MWCOG, 2010a). The NCR jurisdictions are: 

• Washington, D.C. 

• Maryland: Montgomery County and the incorporated cities of 
Gaithersburg, Rockville, and Takoma Park; and Prince Georges County 
and the incorporated cities of Bowie, College Park, and Greenbelt. 

• Virginia: Alexandria (city); Arlington County; Loudon County; Fairfax 
County with its incorporated cities of Falls Church and Fairfax City; and 
Prince William County with its incorporated cities of Manassas and 
Manassas Park. (MWCOG, 2010a) 

With 2,500 square miles and a population of over five million, the NCR is the 
fourth largest metropolitan area in the country (MWCOG, 2010a, p. 4). It has a gross 
regional product of $288.3 billion, fourth largest in the nation (MWCOG, 2010a, p. 4). It 
is home to 271 federal departments and agencies; 340,000 federal employees; the 
Pentagon; all three branches of the federal government; more than 40 colleges and 
universities; and more than 2,000 political, social, and humanitarian non-profit 
organizations (MWCOG, 2010a, pp. 4-5). In addition, 20 million tourists visit the region 
annually, and the number of visitors and foreign nationals residing in the NCR at any one 
time is more than any other metropolitan area in the country (MWCOG, 2010a, pp. 4-5). 
Many employees commute to work in the NCR from the surrounding states of West 
Virginia and Pennsylvania, as well as from mid to southern regions of Virginia 
(MWCOG, 2010a, p. 4). 

In addition to large numbers of visitors and employees, the NCR contains major 
transportation infrastructure such as interstate highways, heavy rail systems, two 
international airports, many roadways and bridges, the second largest commuter rail 
system, and the fifth largest bus system in the United States (MWCOG, 2010a, p. 5). 
From the international perspective, the NCR is host to more than 170 embassies, the 
International Monetary Fund, the World Bank, the Organization of American States, and 
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other international entities (MWCOG, 2010a, p. 5). Furthennore, the public schools of 
just one NCR jurisdiction teach students from 157 countries speaking 138 different 
languages (Montgomery County Public Schools, 2012, p. 1). 

As far law enforcement goes, all of the eight major NCR counties and cities have 
police or sheriffs departments that provide the full range of police services, including the 
investigation of serious felonies such as murders, sexual offenses, and armed robberies. 
Some of the smaller townships and incorporated municipalities also have full-service 
police departments that share law enforcement (LE) duties with the county’s primary LE 
agency. Other townships and municipalities provide some LE services but do not have 
primary investigative responsibility for serious felonies. The state police departments in 
both Virginia and Maryland conduct traffic operations on interstate highways and 
designated state roads in the NCR, but they do not normally have criminal investigative 
responsibilities within the NCR jurisdictions. If requested, state police investigators will 
respond to assist local LE for a serious crime spree; however, neither state police agency 
would be the primary investigative agency in NCR jurisdictions. 

For federal LE, the NCR is divided between the Baltimore and Washington Field 
Offices of the FBI. The Baltimore Field Office has investigative responsibility for the 
Maryland counties of Montgomery and Prince Georges (FBI, n.d.). The Washington 
Field Office has investigative responsibility for Washington, D.C., and the northern 
Virginia jurisdictions of Alexandria, Arlington County, Fairfax County, Loudoun 
County, and Prince William County (FBI, n.d.). 

Additionally, three fusion centers serve the NCR: 1) the Maryland Coordination 
and Analysis Center (MCAC); 2) the Washington Regional Threat Analysis Center 
(WRTAC) in Washington, D.C.; and (3) the Northern Virginia Regional Intelligence 
Center (RIC) in Virginia (DHS, n.d.). 

The NCR is supported by the Metropolitan Washington Council of Governments 
(COG or MWCOG), a regional, non-governmental, independent, and non-profit 
organization formed in 1957 to facilitate regional planning in the Washington, D.C., area 
(MWCOG, n.d.). COG is supported by contributions from its member jurisdictions, 
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grants, and donations (MWCOG, n.d.). The NCR and COG jurisdictions overlap, except 
that COG encompasses the two additional counties of Frederick and Charles in Maryland, 
the incorporated city of Frederick in Frederick County, and the town of Bladensburg in 
Prince George’s County (MWCOG, n.d.). Other COG membership includes members of 
the Maryland and Virginia legislatures, the U.S. Senate, and the U.S. House of 
Representatives (MWCOG, n.d.). COG’s mission is to: 

Enhance the quality of life and competitive advantages of the Washington 
metropolitan region in the global economy by providing a forum for 
consensus-building and policy-making; implementing intergovernmental 
policies, plans, and programs; and supporting the region as an expert 
information resource. (MWCOG, n.d.) 

Since 1957, COG has evolved into a structure that forms the latticework for how 
the NCR conducts preparedness activities within the scope of the National Response 
Framework (MWCOG, 2010b, pp. B2-7). COG supports the NCR’s regional emergency 
support functions (R-ESFs), which mirror FEMA’s National Response Framework that 
groups resources by functions (MWCOG, 2010b, pp. B5-7). The R-ESFs are comprised 
of practitioners and subject matter experts (SMEs) that coordinate preparedness activities 
to build the capabilities necessary to respond to and recover from disasters (MWCOG, 
2010b, p. B5). The following are examples of the R-ESF lead committees, which can be 
found on the MWCOG Committee Business website (n.d.): the Fire Chiefs Committee 
(R-ESF #4, 9 and 10), the Police Chiefs Committee (R-ESF #13), and the External 
Affairs Committee (R-ESF #15). The R-ESF committees report to the Chief 
Administrative Officers’ Homeland Security Executive Council (CAO-HSEC), which is 
comprised of the Chief Administrative Officers of the eight primary NCR jurisdictions 
(MWCOG, 2010b, p. B3). Additional infonnation about the governance structures of 
COG can be found in Appendix B of the NCR 2010 Homeland Security Strategic Plan. 

A. NCR HOMELAND SECURITY STRATEGIC PLAN 2010-2013 
(STRATEGIC PLAN) 

The NCR released its latest Homeland Security Strategic Plan (Strategic Plan) in 
October of 2010; it outlines the NCR’s plan for achieving its priority capabilities over the 
next three to five years (MWCOG, 2010a, p. 1). The Strategic Plan : 
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... affirmed the National Capital Region’s commitment to a common 
vision of working together towards a safe and secure National Capital 
Region to achieve its mission of building and sustaining an integrated 
effort to prepare for, prevent, protect against, respond to, and recover from 
‘all hazards’ threats or events. (MWCOG, 2010a, p. 1) 

The NCR leaders took a capabilities-based approach to planning in which they 
identified the risks faced by the NCR and the capabilities needed to reduce those risks, 
using the Department of Homeland Security’s target capabilities list (TCL) as a guiding 
light (MWCOG, 2010b, p. A2). NCR leaders will link project decisions and funding 
allocations to support building those capabilities (MWCOG, 2010b, p. A2) that not only 
support regional preparedness, but also foster the growth of inter-jurisdictional 
relationships (MWCOG, 2010b, p. C2). 

The central themes of the Strategic Plan include community engagement and 
regional collaboration for planning and decision making (MWCOG, 2010a, p. 1). 
Principal goals include enhancing regional capabilities for developing interoperable 
communications for voice, data, and video (MWCOG, 2010a, p. 7). They also include 
enhancing infonnation-sharing and situational awareness, especially with the public, law 
enforcement agencies, and fusion centers (MWCOG, 2010a, pp. 8-9), and regional 
planning, training, and exercising to develop, test, and validate capabilities (MWCOG, 
2010a, p. 14). The Strategic Plan recognizes that regional emergency support functions 
(R-ESFs) are responsible for identifying preparedness gaps and notifying appropriate 
NCR leadership committees of the need for grant funds and other resources to close those 
gaps (MWCOG, 2010b, pp. B3, B5). Federal grants have been a significant source of 
funding to achieve the goals set out in the Strategic Plan (MWCOG, 2010a, p. 15). 

According to the Strategic Plan, R-ESF #13 “...focuses on facility and resource 
security; security planning; technical resource assistance; public safety and security 
support; and support for traffic and crowd control” (MWCOG, 2010b, p. B7). The COG 
Police Chiefs Committee is the lead for R-ESF #13 and is comprised of senior executive 
officers from federal, state, and local LE agencies in the NCR (MWCOG, n.d.). There are 
seven subcommittees of the Police Chiefs Committee: Training, Intelligence, Planners, 
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Chaplains, Technology, Communications, and SWAT (MWCOG, n.d.). There is no 
existing subcommittee for investigations. 

The NCR Regional Emergency Coordination Plan (RECP) is a plan to enhance 
regional communications and coordination during a disaster, emergency, or incident 
(MWCOG Task Force on Homeland Security, 2002, p. 2). According to the RECP R- 
ESF #13 Annex (law enforcement), the RECP contains scalable plans for each of the R- 
ESFs, including R-ESF #13, law enforcement (MWCOG Task Force on Homeland 
Security, 2002, p. 2). This annex commits LE to using the Incident Command System to 
coordinate police resources and responses when working in a mutual aid capacity 
(MWCOG Task Force on Homeland Security, 2002, p. 13-3). The 2012 Greater 
Metropolitan Washington Area Police Mutual Aid Operational Plan also strongly 
supports the use of the Incident Command System when working in a mutual aid capacity 
(MWCOG Police Chiefs Committee, 2012, pp. 3, 4, 8, 9, 14). 

The Regional Incident Communications and Coordination System (RICCS) is a 
primary component of the RECP (MWCOG, 2010, p. 2). The RICCS is a system for intra 
and inter-R-ESF communication and coordination for incidents or emergencies that 
provides text messages and conference call capabilities to pre-identified groups to 
facilitate situational awareness and coordination of resources (MWCOG, 2009, p. 2). 
RICCS may be a good way to initiate communication and coordination during a 
multijurisdictional LE investigation; however, the RECP is not designed for the complex 
communication needs of a prolonged regional investigation (MWCOG Task Force on 
Homeland Security, 2010, pp. 12-14). No such long-term LE regional communication, 
coordination, and information-sharing system exits in the NCR. This paper will address 
this issue. 

The NCR is home to the NCR Incident Management Team (IMT), a FEMA Type 

3 IMT consisting of over 100 members from various NCR jurisdictions and disciplines to 

include fire, EMS, LE, emergency management, and public health (NCR Incident 

Management Team, n.d., p. 1). The team can provide a full range of ICS functions and 

can support local jurisdictions in the management of large-scale preplanned events and 

incidents arising from terrorism, crime, and natural disasters (NCR Incident Management 
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Team, n.d., p. 2). Its personnel have received extensive training in ICS command and 
general staff positions, as well as subunits under the general staff positions (NCR 
Incident Management Team, n.d., p. 2). The IMT’s Logistics Section is fully prepared to 
stand up a command post to support a large operation. It has the trained personnel, 
computers, copiers, printers, smart boards, projectors, and other equipment necessary for 
a command post (NCR Incident Management Team, n.d., p. 2). The Planning Section has 
the capability for planning for multiple operational periods and has over a dozen people 
trained to be a Planning Section Chief (NCR Incident Management Team, n.d., p. 2). The 
Finance/Administration Section can document all the costs associated with the incident, 
and the LE/intelligence element can assist local LE agencies in the management of an 
investigation (NCR Incident Management Team, n.d., p. 2). The NCR IMT has 
experience in managing parts of response and recovery operations in four hurricanes in 
states bordering the Gulf of Mexico (NCR Incident Management Team, n.d., p. 1). 

Within the NCR there are several regional programmatic working groups 
(RPWGs) consisting of practitioners, policymakers, and representatives from 
government, civic, and private sectors (MWCOG, 2010b, p. B7). The responsibilities of 
the RPWGs include fdling gaps and coordinating activities across emergency support 
functions, and focusing attention on priority concerns (MWCOG, 2010b, p. B7). One of 
these RPWGs is the Exercise and Training Operations Panel (ETOP), whose mission and 
scope is to establish and monitor a collaborative and regional approach to training and 
exercises (MWCOG, 2010b, p. B8). Two of the tasks associated with ETOP’s mission 
are: 1) to develop and implement initiatives that focus on enhancing regional training and 
exercises across the spectrum of federal, state, and local NCR partners; and to 2) manage 
an exercise and training budget to support regional and interdisciplinary training and 
exercise initiatives (MWCOG, 2010b, p. B8). There is an ETOP subcommittee of 14 
exercise and training professionals assigned to the major NCR jurisdictions, the states of 
Virginia and Maryland, and other smaller NCR jurisdictions to support training and 
exercise activities (MWCOG, 2010c, p. 7). 

The NCR is a prominent region for national and international reasons. A major 
disruption of life in the NCR can have cascading effects regionally, nationally, and 
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internationally. The NCR is politically fragmented in many ways—consisting of layers of 
federal, state, and local governments encompassing 18 jurisdictions from Maryland, 
Virginia, and the District of Columbia. Consequently, emergency support functions such 
as LE/intelligence, fire/EMS, and public infonnation are also fragmented. There are, 
however, regional structures, planning documents, and grants that support collaboration 
(e.g., MWCOG, the NCR, R-ESFs, RPWGs, the NCR Homeland Security Strategic Plan, 
federal grants, and others). 

To understand the issues and challenges in managing regional investigations, the 
NCR does not need to start from scratch. Managing a Multijurisdictional Case, the after¬ 
action analysis of the DC Sniper case investigation published by the Police Executive 
Research Forum, identifies a number of lessons-learned from that investigation (Murphy 
& Wexler, 2004). The following chapter will discuss this report and attempt to glean 
wisdom from the experiences of those who participated in that investigation. 
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III. LESSONS LEARNED FROM THE DC SNIPER CASE 


From October 2-21, 2002, 10 people were murdered and three more wounded by 
rifle fire in a series of attacks that came to be known as the DC Sniper case. The 
shootings occurred in five NCR jurisdictions and two Virginia jurisdictions south of the 
NCR (Murphy & Wexler, 2004, pp. 7-12). The suspects’ method of operation was to 
shoot innocent victims in very public places using a high powered rifle, and ATF 
ballistics tests confirmed the linkage between most of the shootings (p. 70). More than 30 
federal, state, and local LE agencies participated in this intergovernmental, interagency, 
and multijurisdictional investigation (Murphy & Wexler, 2004, p. 1). Local LE agencies 
in the jurisdictions that experienced shootings were the lead agencies, while state and 
federal LE agencies provided massive support (Murphy & Wexler, 2004, pp. 36, 38, 39). 

After the conclusion of the investigation, the Department of Justice contracted 
with the Police Executive Research Forum (PERF) to conduct an after action analysis of 
the investigation (Murphy & Wexler, 2004, p. 3). Gerard Murphy and Chuck Wexler 
wrote the report titled Managing a Multijurisdictional Case: Identifying Lessons-learned 
from the Sniper Investigation, hereafter referred to as the PERF report. They collected 
data for this report by: 

1. conducting more than 100 interviews with key LE personnel involved in 
the investigation, including decision-makers, chief executives, and other 
leaders; 

2. conducting focus groups of others involved in the investigation; 

3. reviewing documents; and 

4. visiting facilities and locations. (Murphy & Wexler, 2004, p. 4) 

A. TIMELINE OF DC SNIPER SHOOTINGS 

This chapter will chart the timeline of the shootings to portray the dynamic nature 
and scope of the crimes, and it will present some of the predominant lessons-leamed and 
recommendations delineated in the report. The following is a summary timeline of the 
shootings and the arrest of the responsible subjects (Murphy & Wexler, 2004). 

• Day 1: Wednesday, October 2, 2002 . Shooting 1: At approximately 5:20 
PM, a rifle bullet was fired through the front windows of the Michaels 
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Craft Store in Aspen Hill, Montgomery County, Maryland, just missing a 
cashier working inside (p. 7). 

• Day 1: (continued) . Shooting 2: At 6:04 PM, 55-year old James Martin 
was shot in the torso and killed in the parking lot of the Shoppers Food 
Warehouse in Wheaton, Montgomery County, Maryland as he walked 
from his vehicle towards the store (p. 7). 

• Day 2: Thursday, October 3, 2002 . Shooting 3: At approximately 7: 41 
AM, 39-year old James Buchannan was shot in the torso and killed while 
mowing grass at an automobile dealership in Rockville, Montgomery 
County, Maryland (p. 7). 

• Day 2: (continued) . Shooting 4: At approximately 8:12 AM, 54-year old 
Premkumar Walekar was shot in the torso and killed as he pumped gas 
into his taxi in Aspen Hill, Montgomery County, Maryland (p. 7). 

• Day 2: (continued) . Shooting 5: At approximately 8:37 AM, 34-year old 
Sarah Ramos was shot in the head and killed as she read a book while 
sitting on a bench outside a store in a small strip mall in Silver Spring, 
Montgomery County, Maryland (p. 7). 

• Day 2: (continued) . Shooting 6: At approximately 9:58 AM, 25-year old 
Lori Ann Lewis-Rivera was shot in the torso and killed while vacuuming 
her van at a gas station in Kensington, Montgomery County, Maryland (p. 
8 ). 

• Day 2: (continued) . Shooting 7: At approximately 9:20 PM, 72-year old 
Pascal Chariot was shot in the torso and killed while walking along 
Georgia Avenue in Washington, D.C., just inside the border with 
Maryland (p. 8). 

• Day 3: October 3, 2002 . Shooting 8: At approximately 2:30 PM, 43-year 
old Caroline Seawell was shot in the back and wounded as she loaded 
bags into her minivan in Fredericksburg, Spotsylvania County, Virginia 
(p. 8). This location is along Interstate-95 in a county just south of the 
NCR jurisdiction Prince William County, Virginia. 

• Day 6: October 7, 2002 . Shooting 9: At approximately 8:08 AM, 13-year 
old Iran Brown was shot in the torso and wounded in front of his middle 
school in Bowie, Prince Georges County, Maryland (p. 9). 

• Day 8: October 9, 2002 . Shooting 10: At approximately 8:18 AM, 53- 
year old Dean Myers was shot in the head and killed after he pumped gas 
into his car in Manassas, Prince William County, Virginia (p. 9). 

• Day 10: October 9, 2002 . Shooting 11: At approximately 9:30 AM, 53- 
year old Kenneth Bridges was shot in the torso and killed at a gas station 
in Fredericksburg, Spotsylvania County, Virginia (p. 9). 
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• Day 13: October 14, 2002 . Shooting 12: At approximately 9:15 PM, 47- 
year old FBI Analyst Linda Franklin was shot in the head and killed as she 
and her husband were loading supplies in their car in the parking lot of a 
Home Depot store in Falls Church, Fairfax County, Virginia (p. 10). 

• Day 18: October 19, 2002 . Shooting 13: At approximately 7:59 PM, 37- 
year old Jeffrey Hopper was shot in the torso and wounded as he walked 
with his family from a restaurant to his car in Ashland, Hanover County, 
Virginia (p. 10). This jurisdiction is south of the NCR and just north of 
Richmond, Virginia. 

• Day 21: October 22, 2002 . Shooting 14: At approximately 5:56 AM, 35- 
year old Conrad Johnson, a bus driver for the Montgomery County 
government, was shot in the torso and killed as he stood in the doorway of 
his bus in Silver Spring, Montgomery County, Maryland (p. 11). 

• Day 23: October 24, 2002 . At approximately 12:54 AM, a citizen spotted 
John Muhammad and Lee Boyd Malvo sleeping in their vehicle at a rest 
stop off of Interstate 70 in Myersville, Maryland, approximately 45 miles 
north of Washington, D.C., (p. 12). Warrants had been issued for their 
arrest the previous day and a lookout was released to the media shortly 
thereafter (p. 12). At approximately 3:30 AM, tactical teams from the FBI, 
the Maryland State Police, and the Montgomery County Police arrested 
the suspects in their vehicle at the rest stop (p. 12). 

B. COMPLEXITY MARKS THE INVESTIGATION 

The first five murders occurred in Montgomery County, Maryland in less than 16 
hours. Within hours, the Maryland State Police, the Baltimore office of the FBI and the 
Bureau of Alcohol, Tobacco, Firearms, and Explosives (ATF) offered assistance to the 
Montgomery County Police (Murphy & Wexler, 2004, p. 8). On October 7, the 
Montgomery County Chief of Police made a fonnal request to the Department of Justice 
for assistance, and within days a joint operations center (JOC) was set up in an office 
building adjacent to the Montgomery County Police headquarters (Murphy & Wexler, 
2004, p. 10). A JOC is a federal command post established by the ATF and FBI and used 
to manage an investigation using predetennined procedures (Murphy & Wexler, 2004, p. 
21). Hundreds of investigators from dozens of LE agencies worked in the JOC until the 
investigation concluded (Murphy & Wexler, 2004, p. 44). 

While LE has engaged in many task forces investigating high-profile crimes or 
serial crimes, the PERF report identifies distinctive elements of the DC Sniper 
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investigation that heightened the challenges faced by law enforcement agencies (Murphy 
& Wexler, 2004): 

• Sniper : Sniper shootings are very rare events; however, in this series of 
attacks there were six shootings of apparently random victims that 
occurred within the first 24 hours of the spree (p. 13). 

• Multiagency and intergovernmental : Dozens of federal, state, and local 
law enforcement agencies participated in the investigation (p. 13). 

• Ongoing : Following the initial six shootings, there were seven more 
attacks in multiple jurisdictions over the next 19 days (p. 13). Law 
enforcement agencies had to simultaneously investigate the attacks, 
prevent further attacks, respond to new attacks, and provide the other law 
enforcement services they normally provide (pp. 13-14). 

• Media event : More than 1,300 media personnel from local, national, and 
international media organizations were onsite (p. 14). They influenced law 
enforcement strategies and operations by revealing information they had 
discovered about the investigation (p. 14). 

• Community fear : The sensational media coverage and the random nature 
of the shootings contributed to a high level of fear felt by citizens (p. 14). 

• External pressures : The media and community fear brought strong 
pressure on law enforcement to end the shooting spree (p. 14). Many 
national government officials lived in the suspects’ target area, and there 
were suggestions by governmental leaders that the investigation be 
transferred from local law enforcement to federal law enforcement (p. 14). 

• Terrorism : The 9/11 attack occurred the previous year and there was 
concern that this shooting rampage was terrorism-related (p. 14). 

C. LESSONS LEARNED? 

The PERF report lists dozens of “lessons-learned” and recommendations to guide 
law enforcement in preparing for similar investigations in the future; however, four 
themes emerged as the cornerstones for conducting successful investigations: 1) Careful 
planning and preparation; 2) defining roles and responsibilities; 3) managing information 
efficiently; and 4) maintaining effective communication (Murphy & Wexler, 2004, p. 
15). The remainder of this chapter will discuss some of the PERF recommendations 
related to planning for operations in an intergovernmental, interagency, and 
multijurisdictional task force. 
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1. Leadership 

The PERF report examines the role of leadership and the task force structure, and 
makes recommendations for an investigative model (Murphy & Wexler, 2004). The law 
enforcement executive officers from the involved agencies should decide who is in 
command of the investigation and the scope of their authority and decision-making power 
(Murphy & Wexler, 2004, p. 31). In addition law enforcement agencies should identify 
and develop training programs to teach managers the skills they need to manage a task 
force (Murphy & Wexler, 2004, p. 32), including those of managing a command post or 
joint operations center (pp. 46-47). Task force leaders should always speak with one 
voice (Murphy & Wexler, 2004, p. 31) as was done by federal, state, and local law 
enforcement agencies which established a joint information center that functioned as the 
public infonnation conduit for the investigation (Murphy & Wexler, 2004, p. 91). 

2. Task Force Structure 

One task force structure does not necessarily fit all investigations since different 
levels of governmental involvement and different phases of the investigation may have 
different operational requirements (Murphy & Wexler, 2004, p. 31). Additionally, 
command of the task force should be a unified command structure (e.g., the incident 
command system) that will facilitate consensus decision-making; and there should be 
definitive criteria for agency participation and leadership within unified command 
(Murphy & Wexler, 2004, p. 32). The issue of incident command participation and 
structure is a particularly important question to resolve since some agencies may want to 
become part of incident command even though they have not had one of the pattern 
crimes occur in their jurisdiction, or have they contributed many resources to the 
investigation. 

While the main task force was located in Montgomery County, there were four 
other task forces in the northern Virginia and central Virginia (Murphy & Wexler, 2004, 
pp. 21, 114). When there are multiple task forces, all task forces need to communicate 
and cooperate; therefore, a task force coordinator should be appointed who will facilitate 
communications, information-sharing, and investigative management (Murphy & 
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Wexler, 2004, p. 32). Furthermore, task forces should exchange representatives and have 
regular interaction with each other (Murphy & Wexler, 2004, p. 32). Finally, one method 
of providing task force governance is to establish a panel of law enforcement chief 
executives from jurisdictions with investigative responsibility (Murphy & Wexler, 2004, 
p. 32). This is a particularly good recommendation because its helps to provide unified 
command with support and parameters for the investigation. Additionally, NIMS 
provides for this governance feature in its Multiagency Coordination Group (MAC 
Group) element of the Command and Management component (U.S. DHS, 2008a, p. 67). 

3. JOCs 

Local law enforcement agencies should explore planning options for pre¬ 
identifying JOC locations, staffing and equipping them, and training personnel to manage 
them (Murphy & Wexler, 2004, pp. 43, 43, 46, 47). In addition to the JOC, local and state 
LE agencies should become familiar with federal resources that can support a local 
investigation, (Murphy & Wexler, 2004, p. 46). 

4. Working with Other Law Enforcement Executives 

Law enforcement executives should promote regional collaboration for 
establishing a model or guidelines for multijurisdictional investigations (Murphy & 
Wexler, 2004, p. 33). Memoranda of understanding (MOU) and mutual aid agreements 
(MAAs) should be created prior to incidents to identify what needs to be done and how 
agencies will work together during a crisis (Murphy & Wexler, 2004, p. 33). Moreover, 
managers and others should establish intergovernmental, interagency, and inter- 
jurisdictional relationships prior to an incident to facilitate communication, coordination, 
and the sharing of resources (pp. 33, 460). This will help establish a basis of personal 
trust and respect in which egos have to be set aside (Murphy & Wexler, 2004, p. 116). In 
addition, preexisting relationships can help leaders understand the capabilities of each 
agencies and how to access them when needed (Murphy & Wexler, 2004, p. 46), and 
these proved to be critical to the successful outcome of the case (p. 51). 

When using resource assistance from other agencies, there should be a clear 

mission for those resources and a structure for managing them (Murphy & Wexler, 2004, 
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p. 33). In addition, leaders should have a regular schedule for briefings stakeholders both 
inside and outside the investigation (Murphy & Wexler, 2004, p. 33). Using secure 
phones, leaders should have an established routine for conference calls, while specific 
staff should be assigned to manage this function since it requires a great deal of 
preparation, facilitation, and follow up responsibilities (Murphy & Wexler, 2004, p. 33). 

5. Defining Roles and Responsibilities 

The role of investigators will be a little different in a large-scale investigation 
because they will not have the investigative autonomy they normally have (Murphy & 
Wexler, 2004, p. 59), and they may be paired with investigators from other agencies to 
facilitate cross-agency communication and coordination (Murphy & Wexler, 2004, p. 
60). Furthermore, managers may need to take a more active role in the oversight of the 
investigation while letting the investigators be investigators (Murphy & Wexler, 2004, p. 
117). These modified roles need to be clearly communicated to the affected personnel 
(Murphy & Wexler, 2004, p. 31). 

6. Case Management 

There should be accountability to a single command structure throughout the 
investigation (Murphy & Wexler, 2004, p. 74), such as unified command. A case 
management system should: 

... be an electronic repository for all tips, leads, and information; be 
compatible with systems in other agencies; be web-based and accessible to 
authorized agencies; feed multiple info systems with one-time entry; 
perfonn sophisticated data analysis such as cross checking and 
soundexing; and provide action tasks for investigators. (Murphy & 

Wexler, 2004, p. 74) 

Investigators need to be familiar with the technology and should use the same 
case management system they use every day, if possible (Murphy & Wexler, 2004, p. 7). 

7. Managing Leads 

This type of investigation requires a robust lead-management system along with 
the protocols for reviewing investigative work, decision making, conducting interviews 
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and interrogations, and maintaining quality control (Murphy & Wexler, 2004, p. 60). In 
addition, agencies should plan to set-up and staff a tip line with technology capable of 
answering multiple lines (Murphy & Wexler, 2004, p. 74). The Sniper case tip line 
received over 100,000 calls and generated 16,000 leads for follow up investigation 
(Murphy & Wexler, 2004, p. 62). 

8. Intelligence 

The Maryland State Police set-up and staffed the intelligence component at the 
MCP training academy; however, because of communication problems arising from the 
separation of the investigators in the JOC from the intelligence officers at the academy, 
the intelligence function was transferred to the JOC (Murphy & Wexler, 2004, pp. 67- 
68). The intelligence officers felt as though they were out of the loop when stationed 
away from the JOC (Murphy & Wexler, 2004, p. 69); therefore, the intelligence function 
should be collocated with the operational and command components and have the 
necessary technology support staff to sustain this function (p. 75). Moreover, secure 
communications for the sharing of law enforcement data should be used (Murphy & 
Wexler, 2004, p. 72). 

9. Media 

Prior to an incident, craft a media plan that identifies duties and responsibilities, 
ways to manage the media at crime scenes and press conferences, and agencies’ points of 
contact for the media (Murphy & Wexler, 2004, p. 100). As with the law enforcement 
executives, the public infonnation officers should attend training to prepare them to work 
in those environments and to cultivate relationships with their counterparts in other 
jurisdictions (Murphy & Wexler, 2004, p. 101). A joint information center (JIC) should 
be established by the agencies participating in the investigation (Murphy & Wexler, 
2004, p. 101). 


10. Prosecutors 

Because coordination and communication between investigators and prosecutors 
is imperative, prosecutors should be integrated into the investigation early in the process 
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(Murphy & Wexler, 2004, p. 58). Similar to what a joint information center (JIC) does 
for public information officers, the JOC designated a room where federal and local 
prosecutors could coordinate their discussion with each other and the investigators 
(Murphy & Wexler, 2004, p. 58). Furthermore, protocols should be identified for how the 
prosecution function can integrate with the investigative function to ensure that 
investigative processes are used that will facilitate the eventual prosecution of the cases 
(Murphy & Wexler, 2004, p. 60). 

Preparation for this type of case will have a large impact on NCR’s ability to 
respond to similar cases in the future (Murphy & Wexler, 2004, p. 116). Law 
enforcement executives should meet to address the issues outlined in the PERF report and 
to draft a blueprint for working together during an incident similar to the Sniper case 
(Murphy & Wexler, 2004, p. 116). Law enforcement leaders need to ask themselves the 
following questions during that preparation phase (Murphy & Wexler, 2004): 

• “How would we detennine who should take the lead?” (p. 116) 

• “Where would the task force be headquartered?” (p. 117) 

• “What is the media plan?” (p. 117) 

• “How can we keep our patrol forces well-briefed?” (p. 117) 

• “How would we communicate with the public, victims, and suspects?” (p. 
117) 

• “Do we have MOUs with other agencies?” (p. 117) 

• “What kind of information management system do we have? Others 

have?”(p. 117) 

• “What are everyone’s roles and responsibilities?” (p. 117) 

• “How do we effectively communicate within our own agency? Other 

agencies? The Public?” (p. 117) 

• “How do we evaluate our effectiveness?” (p. 117) 

The PERF report is based upon the experiences of an intergovernmental and 
interagency law enforcement investigation of a dynamic and serious multijurisdictional 
crime spree (Murphy & Wexler, 2004). This chapter has highlighted some of the 
principal planning and operational recommendations made in the report based upon the 
lessons-leamed from the DC Sniper case. In short, the report states, “Law enforcement 
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needs to explore how to better manage investigations and task forces involving multiple 
agencies and levels of government...” (Murphy & Wexler, 2004, p. 31). 

The PERF report (Murphy & Wexler, 2004) recommends the use of a standard 
incident management system such as the National Incident Management System’s 
(NIMS) Incident Command System (ICS) that was mandated by Homeland Security 
Presidential Directive 5 (HSPD-5) for most jurisdictions in the U.S. (White House, 
2003). Multijurisdictional investigations should use NIMS, but there are useful 
components from another incident management model that may be helpful to incorporate. 
The next chapter will focus on the use of principles from the U.S.’s NIMS and the United 
Kingdom’s “Gold-Silver-Bronze” incident management models in fashioning an NCR 
multijurisdictional investigative framework. 
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IV. MANAGEMENT OF THE INVESTIGATION 


Managing tasks and resources from various disciplines and levels of government 
during a regional investigation can be a daunting job complicated by a lack of command, 
control, coordination, and communication, especially in the early stages of the 
investigation (DHS, 2008a, pp. 3, 5-6). A model for incident management can help to 
manage tasks and integrate the various resources to provide a coordinated and effective 
investigative response (DHS, 2008a, pp. 3, 5, 6). This chapter will explore how the NCR 
can improve its strategic and tactical investigative responses by utilizing a blend of the 
best characteristics of the incident management models of the United States (U.S.) and 
the United Kingdom (UK). In the U.S., that management model is known as the National 
Incident Management System (NIMS) and in the UK that management model is known 
as the Gold-Silver-Bronze. 

A. NATIONAL INCIDENT MANAGEMENT SYSTEM (NIMS) 

On February 28, 2003, President George W. Bush issued Homeland Security 
Presidential Directive 5 (HSPD-5) “To enhance the ability of the United States to 
manage domestic incidents by establishing a single, comprehensive national incident 
management system” (White House, 2003, p. 1). The first paragraph of HSPD-5 outlines 
the policy of the United States (White House, 2003, p. 1): 

To prevent, prepare for, respond to, and recover from terrorist attacks, 
major disasters, and other emergencies, the United States Government 
shall establish a single, comprehensive approach to domestic incident 
management. The objective of the United States Government is to ensure 
that all levels of government across the Nation have the capability to work 
efficiently and effectively together, using a national approach to domestic 
incident management. 

HSPD-5 mandates the adoption of the NIMS by all federal departments and 
agencies as well as entities that receive federal preparedness assistance, grants, and 
contracts (DHS, 2008a, p. 4); consequently, all states and most local jurisdictions are 
required to adopt the NIMS model for incident management. 
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According to the U.S. Department of Homeland Security’s (DHS) National 
Incident Management System, one of the five main components of NIMS is command 
and management (DHS, 2008a, p. 45). The three primary elements of the command and 
management component are: 1) the incident command system; 2) multiagency 
coordination systems (MACS); and 3) public infonnation (DHS, 2008a, p. 45). 

1. Incident Command System 

According to the National Incident Management System (DHS, 2008a): 

ICS is a widely applicable management system designed to enable 
effective, efficient incident management by integrating a combination of 
facilities, equipment, personnel, procedures, and communications 
operating within a common organizational structure. ICS is a fundamental 
form of management established in a standard fonnat, with the purpose of 
enabling incident managers to identify the key concerns associated with 
the incident—often under urgent conditions—without sacrificing attention 
to any component of the command system (p. 45). 

ICS is used to organize on-scene operations for a broad spectrum of 
emergencies from small to complex incidents, both natural and manmade. 

The field response level is where emergency management/response 
personnel, under the command of an appropriate authority, carry out 
tactical decisions and activities in direct response to an incident or threat. 
Resources from the Federal, State, tribal, or local levels, when 
appropriately deployed, become part of the field ICS as prescribed by the 
local authority, (p. 46) 

As a system, ICS is extremely useful; not only does it provide an 
organizational structure for incident management, but it also guides the 
process for planning, building, and adapting that structure. Using ICS for 
every incident or planned event helps hone and maintain skills needed for 
the large-scale incidents, (p. 46) 

ICS is used by all levels of government—Federal, State, tribal, and local— 
as well as by many NGOs and the private sector. ICS is also applicable 
across disciplines. It is normally structured to facilitate activities in five 
major functional areas: Command, Operations, Planning, Logistics, and 
Finance/Administration. Intelligence/Investigations is an optional sixth 
functional area that is activated on a case-by-case basis, (p. 46) 

ICS was created in the 1970s by the Firescope Program, which was designed by 
federal, state, and local firefighting agencies in California to facilitate integrated 
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operations while fighting large-scale forest fires (Buck, Trainor, & Aguirre, 2006, p. 1). 
ICS is a management tool for organizing work and the resources to accomplish that work, 
utilizing principles based upon traditional management theory: (1) standardized job 
descriptions; (2) common terminology; (3) chain of command; (4) unity of command; (5) 
span of control; (6) scalable & modular structure; (7) authority commensurate with 
responsibility; and (8) management by objectives (Buck et ah, 2006, p. 1). 

During the 1980s and 1990s, the federal government incorporated ICS elements 
into the Federal Response Plan (FRP) and the Emergency Response Team (ERT) (Buck 
et ah, 2006, p. 2). The 9/11 attacks on the World Trade Center and the Pentagon 
demonstrated the need to have a national response plan for the management of disasters. 
ICS was used at the Pentagon to organize the collaboration and response of multiple 
disciplines (Titan, 2003, pp. 11, A21, A28, A48, C13-16). The Pentagon response after 
action report concluded that the Pentagon response was well-organized and that ICS was 
a substantial contributor to that success (Titan, 2003, p. 11). The 911 Commission Report 
agreed with this assessment when it acknowledged that: 

The emergency response at the Pentagon represented a mix of local, state, 
and federal jurisdictions and was generally effective. It overcame the 
inherent complications of a response across jurisdictions because the 
Incident Command System, a formalized management structure for 
emergency response, was in place in the National Capital Region on 9/11. 
(National Commission for the Terrorist Attacks upon the United States. 

[9/11 Commission], 2004, p. 314) 

Conversely, the response to the WTC attack was not well-organized for days 
afterward (Buck et ah, 2006, p. 10; 9/11 Commission, 2004, pp. 319-321). One of the 
reasons cited for the unorganized and uncoordinated response was the lack of an accepted 
management response model (9/11 Commission, 2004, pp. 319-321). 

Within ICS, command authority for response actions resides with the Incident 
Commander or Unified Command (DHS, 2008a, pp. 49-50). NIMS recommends that a 
single incident commander be in charge in those incidents that involve single agencies 
within a single jurisdiction (DHS, 2008a, pp. 49-50); however, for incidents that span 
multiple jurisdictions or involve multiple response agencies, representatives from those 
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agencies and jurisdictions manage the incident using unified command (DHS, 2008a, pp. 
49-50). Unified command affords the opportunity for multiple agencies and jurisdictions 
to provide input into an integrated management organization that is working towards the 
goal of achieving common objectives within the oral or written incident action plan 
(DHS, 2008a, p. 49-50). The advantages of unified command for a multijurisdictional 
investigation are: 

• All agencies are working on a single set of objectives; 

• A single set of objectives is developed for the entire incident; 

• A collective approach is used to develop strategies to achieve incident 
objectives; 

• Infonnation flow and coordination are improved between all jurisdictions 
and agencies involved in the incident; 

• All agencies with responsibility for the incident have an understanding of 
joint priorities and restrictions; 

• No agency’s legal authorities will be compromised or neglected; 

• The combined efforts of all agencies are optimized as they perform their 
respective assignments under a single IAP [Incident Action Plan] (DHS, 
2008a, p. 50). 

The ICS model provides a useful structure for supporting incident command 
during regional investigations (pp. 49-51). The other four primary functional divisions of 
labor in ICS are the Operations Section, Planning Section, the Logistics Section, and the 
Administration/Finance Section (pp. 54-59). 

a. Operations Section 

The Operations Section manages the tactical response to an incident or an 
investigation (DHS, 2008a, p. 54). When many resources and/or functions are involved in 
the tactical response, ICS provides additional sub groupings such as branches, groups, 
divisions, task forces, and strike teams (DHS, 2008a, pp. 97-102). These structures 
ensure that key management principles are followed when organizing resources. 
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b. Planning Function 

The Planning Section collects, evaluates, and disseminates infonnation; 
maintains the status of resources and situational awareness; and prepares incident action 
plans and maps (DHS, 2008a, p. 103). 

c. Logistics Function 

The Logistics Section manages the logistical requirements of all agencies; 
establishes and furnishes facilities such as the command post; and secures necessary 
equipment, vehicles, supplies, and personnel (DHS, 2008a, p. 107). 

d. Financial Management 

The Finance/Administration Section establishes procurement procedures 
and tracks the expenses of an operation (e.g., personnel, equipment, rentals, travel, 
supplies, workers compensation). (DHS, 2008a, pp. 113-114). 
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Figure 4. ICS Organizational Structure (From FEMA, 2010) 
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When investigations become less dynamic or even routine, the need to 
have the planning, logistics, or finance sections may dissipate. Because ICS is a modular 
system, incident command should mobilize only those functions necessary to manage an 
incident and demobilize them when no longer needed (DHS, 2008a, pp. 38, 47). Figure 4 
depicts an ICS chart with most of its functional structures. 

2. Multiagency Coordination Systems (MACS) 

After ICS, the second element of the NIMS Command and Management 
component is the Multiagency Coordination System (MACS), which is: 

... a system that provides the architecture to support coordination for 
incident prioritization, critical resource allocation, communications 
systems integration, and information coordination. MACS assist agencies 
and organizations responding to an incident. The elements of MACS 
include facilities, equipment, personnel, procedures, and communications. 

Two of the most commonly used elements are Emergency Operations 
Centers and MAC Groups. (DHS, 2008a, p. 143) 

A MAC Group is: 

... a group of administrators or executives, or their appointed 
representatives, who are typically authorized to commit agency resources 
and funds. A MAC Group can provide coordinated decision-making and 
resource allocation among cooperating agencies, establish the priorities 
among incidents, hannonize agency policies, and provide strategic 
guidance and direction to support incident management activities. (DHS, 

2008a, p. 143) 

3. Public Information 

The third element of the NIMS command and management component is public 
information. This element specifies a joint information system (JIS) to unify the public 
information function of multiple agencies and/or jurisdictions in a joint infonnation 
center (JIC) that coordinates public infonnation releases (DHS, 2008a, pp. 70-71). 

NIMS online training modules are available through the NIMS Resource Center 
while dozens of NIMS/ICS online and classroom courses are advertised on the 
FEMA/Emergency Management Institute (EMI) website (e.g., IS-700, Introduction to 
NIMS; IS-100, Introduction to ICS; IS-200, ICS for Supervisors; ICS-300, Intennediate 
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ICS for Expanding Incidents; ICS-400, Advanced ICS for Command and General Staff: 
Complex Incidents. 

B. THE UK GOLD-SILVER-BRONZE MODEL 

As a result of large-scale riots in 1985, the UK created the Gold-Silver-Bronze 
domestic incident management model for handling local incidents (Arbuthnot, 2008, p. 
186). The concepts of this model are explained in the UK documents: 

1. Emergency Response and Recovery Plan (HM Government of the UK, 

2010 ); 

2. Responding to Emergencies: The UK Central Government Response 
Concept of Operations (Cabinet Office, 2010); and 

3. the Major Incident Procedure Manual (London Emergency Services 
Liaison Panel, 2007). 

There are three main structural levels of incident management within the UK 
model: the Bronze level, the Silver level, and the Gold level (Cabinet Office, 2010, pp. 
49-50; HM Government, 2010, pp. 63-74; London Emergency Services Liaison Panel, 
2007, p. 21). 
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Figure 5. The UK’s Gold-Silver-Bronze Model 


1. Bronze (Operational) 

The Bronze level is where the operational work is perfonned at the site of the 

emergency (Cabinet Office, 2010, p. 49-50). Each response agency has a Bronze 

commander who manages the operational tasks associated with his/her own agency 

(Cabinet Office, 2010, p. 49-50), but who does not have control over resources from 

other agencies (HM Government, 2010, p. 63). Bronze level officers are expected to 
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coordinate with their counterparts to ensure that inter-agency operations run as smoothly 
as possible (Cabinet Office, 2010, p. 50). Examples of Bronze level operations for law 
enforcement agencies would be to establish perimeters, to conduct traffic and pedestrian 
control, to provide security to the response areas, and to conduct investigations (Cabinet 
Office, 2010, p. 49-50). Furthennore, the Bronze level is roughly equivalent to the 
Operations Section in the ICS model. 

The UK model uses the principle of subsidiarity that emphasizes “decisions 
should be made at the lowest appropriate level, with coordination at the highest necessary 
level” (Cabinet Office, 2010, p. 5). Only when emergency operations become larger is 
there a need to establish the higher levels of Silver and Gold. 

2. Silver (Tactical) 

Silver level officials are typically more senior officials who have command and 
coordination authority over agency resources, and they ensure that the actions taken by 
the Bronze level are coordinated and integrated to facilitate maximum effectiveness and 
efficiency (Cabinet Office, 2010, p. 50). If the Silver level is activated, each of the 
primary response agencies will provide a Silver level officer who will coordinate with the 
other Silvers to ensure an integrated operation (Cabinet Office, 2010, p. 50). The Silver 
level is roughly equivalent to the Unified Command level in the ICS model. 

3. Gold (Strategic) 

According to the UK’s Emergency Response and Recovery Plan, 

The purpose of the Strategic level is to consider the emergency in its wider 
context; detennine longer-tenn and wider impacts and risks with strategic 
implications; define and communicate the overarching strategy and 
objectives for the emergency response; establish the framework, policy 
and parameters for lower level tiers; and monitor the context, risks, 
impacts and progress towards defined objectives. (HM Government, 2010, 
p. 69) 

Gold level personnel are not command personnel for the incident, but rather have 
a coordinating and supporting role for the Silver level leadership (HM Government, 
2010, p. 63). They are the senior personnel from the primary agencies providing a 
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response to the incident who have the authority to commit the agencies resources 
(London Emergency Services Liaison Panel, 2007, pp. 23-24). A police or fire chief or 
deputy chief would be an example of a Gold level official. 

The Gold level personnel will form a strategic coordinating group (SCG), 
which is widely referred to as the “Gold Group” (Cabinet Office, 2010, p. 

7). For most incidents, Gold Group is chaired by the law enforcement 
Gold official (Cabinet Office, 2010, p. 7); however, in some emergencies, 
such as a health emergency, it may be more appropriate to have a health 
department Gold official as the chair of the SCG (HM Government, 2010, 
p. 73). According to the UK’s Emergency Response and Recovery Plan, 

The SCG does not have the collective authority to issue commands or 
executive orders to individual responder agencies. Each organisation 
represented retains its own command authority, defined responsibilities 
and will exercise control of its own operations in the normal way. (HM 
Government, 2010, p. 72) 

Because the SCG would be formed for incidents spanning multiple operational 
periods, a sufficient number of senior leaders need to be trained and exercised to perform 
this function (HM Government, 2010, p. 72). The Multiagency Coordination Group 
(MAC Group) is the NIMS equivalent to the UK’s Gold level. 

C. INCIDENT COMMAND FACILITY 

There are some differences in how the U.S. and UK incident management models 
handle their command posts. The ICS model provides for a single command post (CP) 
where the Incident Commander/Unified Command (UC) manages the incident (DHS, 
2008a, pp. 49, 117). The Gold-Silver-Bronze model locates its incident command officers 
(Silver) in a Joint Emergency Services Control Center (JESCC) where each response 
agency locates its command and control vehicle into a cluster of vehicles (London 
Emergency Services Liaison Panel, 2007, p. 19). Furthennore, the police Silver has 
responsibility for establishing a liaison with all the command vehicles at the JESCC 
(London Emergency Services Liaison Panel, 2007, p. 19) and for ensuring an interagency 
phone link is established between them (p. 20). The NIMS model relies on co-location of 
command personnel in a single command post; whereas, the UK model relies on a 
network of collocated command posts linked by technology. 
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1 . 


Public Information Function 


The U.S. and UK models have a similar organizational structure for handling 
pubic infonnation. In both models, the media office for the lead department or agency 
will be the primary conduit for the release of information to the public and the 
coordination of media activities (HM Government, 2010, p. 181; DHS, 2008a, pp. 52, 
70). Both models also have a structure for the integration of the various media offices of 
multiple agencies, jurisdictions, or levels of government involved in larger emergency 
responses. The ICS model calls this structure the joint infonnation system (JIS), a 
component of which is the joint infonnation center (JIC) (DHS, 2008a, pp. 70-71). The 
JIC can be an actual or virtual location where the public infonnation officers from 
involved agencies plan and integrated their activities (DHS, 2008a, p. 71). The UK model 
uses the tenn news co-ordination cell (NCC) for this function (HM Government, 2010, p. 
181). 

There are similarities and differences in the two national incident management 
modules. Both systems agree on the need for at least three basic levels of organization to 
manage large-scale incidents. The UK’s model calls these levels Gold, Silver, and 
Bronze. The NIMS’ model has three levels with responsibilities congruent with the UK’s 
model—the MAC Groups, Unified Command, and the Operations Section; however, 
there is much more to the NIMS model than these three structures. Figures 4 and 5 
clearly show that the UK’s Gold-Silver-Bronze model is a simple grouping of functions 
into three basic categories whereas the U.S.’s NIMS model can grow into a complex 
structure for managing a complex incident response. Although more intricate, the NIMS 
model seems to offer more functionality from an organizational and planning perspective 
than the Gold-Silver-Bronze model; however, the Gold-Silver-Bronze model offers some 
insights on how to make an incident management model simpler to understand, and how 
to network multiple response disciplines using available technology. 

NIMS and the Gold-Silver-Bronze national incident management models are 
examples of structures that support collaboration. There are other structural or 
institutional factors that promote collaboration such as training, education, and policies; 

however, structures alone are not sufficient to create a collaborative environment. The 
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next chapter will examine how leadership, technology, and institutional factors can play a 
leading role in creating a team environment in which distinct jurisdictions and disciplines 
can work together effectively, and how certain behaviors and conditions can sabotage 
working relationships. 
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V. COLLABORATION 


According to Presidential Policy Directive 8 (PPD-8) issued in March 2011, “Our 
national preparedness is the shared responsibility of all levels of government, the private 
and nonprofit sectors, and individual citizens” (White House, 2011, p. 1). PPD-8 
mandated the development of a National Preparedness Goal, which was subsequently 
developed by the Secretary of the Department of Homeland Security and issued in 
January 2012. In this success is defined as, “A secure and resilient Nation with the 
capabilities required across the whole community to prevent, protect against, mitigate, 
respond to, and recover from the threats and hazards that pose the greatest risk” (DHS, 
2012, p. 1). The National Preparedness Goal identifies 35 core capabilities necessary to 
support the five homeland security missions of prevention, protection, mitigation, 
response, and recovery (DHS, 2012, p. 2). Three of the core capabilities crosscut all five 
missions: planning, public information and warning, and operational coordination (DHS, 
2012, pp. 2-3), all of which are applicable for developing a framework for 
multijurisdictional and interdisciplinary regional investigations. Developing and 
implementing such a model will require the collaboration of leaders and operational 
personnel within several disciplines, and this chapter discusses those leadership and 
institutional factors that either foster or inhibit collaboration. 

Building a collaborative capacity means: 

• creating, nurturing, and sustaining inter-organizational systems to achieve 
common goals that will yield benefits in cost savings from sharing smart 
practices; 

• making decisions that incorporate a wide range of input; cooperating with 
disperse groups; and promoting innovation by sharing ideas and making 
due with limited resources (Hocevar, Thomas, & Jansen, 2006, p. 2). 

In the last two decades of the twentieth century, organizations were 
deemphasizing their hierarchal structures, empowering employees, and organizing their 
staff into internal work teams (Linden, 2002, p. 3). The first decade of the new millennia 
saw an increase in networking between organizations such as the U.S. Postal Service 
partnering with FedEx to share each other’s ground and air assets; the three levels of 
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government partnering on the management of natural resources; and the CEOs of Ford, 
Chrysler, and GM meeting regularly to share information and ideas (Linden, 2002, p. 3). 
Businesses, various levels of government in the U.S., and even foreign countries have 
recognized the need to collaborate and have established structures to facilitate 
collaboration. 

In 2004, Hocevar, Jansen, & Thomas published their research findings that 
identified the elements that either foster or hinder interagency collaboration. In their 
study, they relied upon literature and experts in the field of collaboration, as well as input 
from 30 senior homeland security managers who participated in a facilitated workshop 
(Hocevar, Jansen, & Thomas, 2004, p. ii.). In 2006, Hocevar, Thomas, & Jansen 
published a follow up study in which they outlined their diagnostic tool to measure the 
collaborative capacity of organizations. They used Kurt Lewin’s “force field” analysis 
model to summarize the driving and restraining forces that work for or against 
interagency change (see Table 1). The model shows how driving and restraining forces 
work against each other to maintain the status quo; whereas, if interagency collaboration 
is to improve, the driving factors must become stronger and/or the restraining factors 
must weaken (Hocevar, Jansen, & Thomas, 2006, p. 5). 
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Table 1. Force-field Analysis for Building Collaborative Capacity (From Flocevar, 

Thomas, & Jansen, 2006, pp. 6-7) 


Force-field Analysis for Building Collaborative Capacity 



Driving Forces 

Restraining Forces 



Organizational 
Design Component 

“Success” Factors that Foster 
Collaborative Capacity 

“Barriers” That Inhibit 
Collaborative Capacity 

Purpose & 

Strateav 

(Driven by a ‘felt 
need” or common 
goal) 

• The “felt need” to collaborate. 

• Common goals or recognized 
interdependence. 

• Adaptable to interests of other 
organizations. 

• Divergent goals. 

• Focus on local organization rather 
than regional view. 

• Lack of goal clarity. 

• Not adaptable to interests of other 
organizations. 

Structure 
(Formal power & 
authority of those 
engaged in 

interagency 
collaboration , p. 7) 

• Formalized coordination 
committee or liaison roles. 

• Sufficient authority of participants 

• Impeding rules or policies. 

• Inadequate authority of participants. 

• Inadequate resources. 

• Lack of accountability. 

• Lack of formal roles or procedures for 
managing collaboration. 

Lateral 

Mechanisms 
(Social capital and 
communication, p. 7) 

• Social capital (e.g., interpersonal 
networks). 

• Effective communication and 
information exchange. 

• Technical interoperability. 

• Lack of familiarity with other 
organizations. 

• Inadequate communication and 
information-sharing (distrust). 

Incentives 

(The payoffs for 
collaboration, p. 7)) 

• Collaboration as a prerequisite for 
funding or resources. 

• Leadership support and 
commitment. 

• Absence of competitive rivalries 

• Acknowledged benefits of 
collaboration (e.g., shared resources). 

• Competition for resources. 

• Territoriality. 

• Organization-level distrust. 

• Lack of mutual respect. 

• Apathy. 

People 

• Appreciation of others’ 
perspectives. 

• Competencies for collaboration. 

• Trust. 

• Commitment and motivation. 

• Lack of competency. 

• Arrogance, hostility, animosity. 


Om 
o £2 

> 73 


o 

o_ 

£5" 

cr 

o 

< 

CD 

O 

“O 

fD 

O 

= 3 " 

cd" 

Q_ 

c n 


“O 

CD 


O 

3 

SD 


O 

CD 


59 























Several influential environmental factors set the context for those driving and 
restraining forces (e.g., inclusion of all the right stakeholders, the history of interagency 
relationships, resource competition or duplication, laws and regulations, and the 
expectations of the public) (Hocevar et al., 2004, p. 32). The public’s expectation that 
agencies and jurisdictions will work together is reflected in various federal, state, and 
local government documents discussed in previous chapters (e.g., Presidential Policy 
Directive 8, the National Preparedness Goal, the National Incident Management System, 
and The NCR Homeland Security Strategic Plan). 

A. LEADERSHIP 

Robert Agranoff looked at the challenges facing managers in working with groups 
and agencies outside of their home organizations in an effort to detennine how 
perfonnance between governmental and non-governmental organizations can be 
improved in a collaborative environment (2005, p. 18). He found eight leadership 
behaviors that public managers should employ to enhance collaborative perfonnance: 

1. send the proper signals to their managers to engage in collaborative policy 
making activities; 

2. promote networks that encourage the flow of information between 
partners; 

3. be creative and proactive in identifying opportunities for improvement; 

4. promote developing collaborative capacity of their organizations; 

5. make strategic public investments that leverage other resources to get the 
most from the investment; 

6. create linkages within the reservoir of human capital; 

7. assess whether there is an added value created by the collaboration; 

8. obtain feedback from the customers, assess the lessons-learned, and make 
the required improvements (2005, pp. 33-39). 

For Agranoff, performance counts since there must be some public valued 
gleaned from the network for collaboration to be worthwhile (Agranoff, 2006, p. 58). He 
sees some potential benefits of collaboration as 1) managers and professionals learning 
new ways to collaborate and enhance technology skills; 2) agencies accessing new 
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information, resources, and training; and 3) agencies mastering new planning capabilities, 
procuring new technology, and building new interagency strategies (Agranoff, 2006, p. 
58). 

A similar view of leadership is espoused by Marcus in Meta-Leadership and 
National Emergency Preparedness. According to Marcus, a meta-leader is a person who 
can transcend the problems of parochialism, rivalries, friction, and a general lack of 
connectivity between government agencies (2006, p. 42-44). A meta-leader fosters cross¬ 
agency interaction, communication, confidence, and a common sense of purpose 
(Marcus, 2006, p. 44). He or she has personal and professional credibility, are skilled in 
the art of negotiation, and seek to influence the actions of those in other agencies 
(Marcus, 2006, p. 45). In short, meta-leaders attempt to harness all the horses so they are 
pulling the cart in the same, and right, direction. These principles are consistent with 
those espoused by Paparone in Deconstructing Army Leadership when he states that 
leadership is about influencing collaborative partners for mutual goals (2004, p. 7). 
Another meta-leader trait is emotional intelligence (Marcus, 2006, p. 52), a quality 
anchored in self-awareness, an inner steadiness, and an ability to empathize and relate 
well to others. These are also qualities that promote leadership, as defined by Paparone 
who sees leadership not so much as accomplishing goals but as fostering common 
sentiments, beliefs, attitudes, values, and commitment (2004, p. 4). 

According to Linden in his article “A Framework for Collaborating,” 
collaborative leaders lead as peers, listen to others, and recruit people into partnerships 
(2002, p. 6). They are often unassuming people whose commitment is to project goals 
rather than their own egos (Linden, p. 6). Linden also states, “It all comes down to 
trust...if parties don’t trust one another, you’re not going to get collaboration” (p. 5). 
Collaborative leaders tend to see the big picture and how to put the right people into the 
right jobs (Linden, 2002, p. 6). 
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B. INSTITUTIONAL FACTORS 

If there is a limited history of engagement between agencies, there may be 
inadequate relationships and trust bonding between parties who find themselves in 
environments where collaboration is essential (Smith, 2007, p. 18). The establishment of 
rules and institutions are ways that governments indicate their commitment to a course of 
action and provide a framework for public managers to fonn networks of partnerships 
that can achieve the goals that working in a collaborative manner can attain, with or 
without a pre-existing basis of trust (Smith, 2007, p. 18). 

1. Joint Investigation Teams in the European Union 

Due to the sovereignty of the European Union (EU) and the fragmented nature of 
law enforcement, the EU has had some historical difficulty conducting transnational 
criminal investigations (Rijken & Venneulen, 2006, p. v). To resolve this problem, the 
EU created the structure for joint investigations teams (JITs) to facilitate investigators 
from different countries banding together to investigate cross-border crimes (Rijken & 
Venneulen, 2006, p. v). An academic study, supported by various EU governmental law 
enforcement agencies, was conducted by a team of international and interdisciplinary 
researches to identify those dynamics that help or hinder collaboration within the JITs 
(Rijken & Venneulen, 2006, pp. v-vii). The study, Joint Information Teams in the 
European Union: From Theory to Practice, provides lessons-learned and 
recommendations based upon that research (Rijken & Venneulen, 2006). 

Mutual trust, the felt need to cooperate, and the desire to share information are 
crucial prerequisites for launching a JIT (Rijken & Venneulen, 2006, pp. 54, 58, 219— 
221, 224, 229). There are three keystones for the founding of a JIT: 1) a legal basis for 
the JIT; 2) the selection of a case by two or more member states; and 3) the management 
of the JIT (Rijken & Venneulen, 2006, pp. 202-210). The EU passed joint legislation that 
laid the legal groundwork upon which JITs can be formed (Rijken & Venneulen, 2006, 
pp. 2, 201, 202). Although there is no set standard for the management of the JIT, Rijken 
and Venneulen recommend an “inner” and “outer” management team model (2006, pp. 
209-210). This paradigm mirrors the NIMS and the Gold-Silver-Bronze models in which 
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the “inner JIT” conducts the day-to-day operations in a facility similar to a U.S. JOC 
(similar to ICS’ unified command / UK’s Silver level), while the “outer JIT” (senior 
representatives of the participating agencies) functions as a steering committee for the 
investigation (similar to ICS’ MAC Group / UK’s Gold level) (Rijken & Vermeulen, 
2006, pp. 209-210). 

JITs are expensive (like JOCs), and their structure must be agreed upon prior to 
their establishment (Rijken & Vermeulen, 2006, p. 221). Because they conduct criminal 
investigations in a novel manner and because they are not used frequently, law 
enforcement requires training for JIT management and operations. The willingness to 
leam from each other, the pairing of investigators from different agencies, and team 
building activities were considered valuable to fonning JITs that worked well together 
(Rijken & Vermeulen, 2006, pp. 216, 217, 227). 

2. Interagency and Multi-Discipline Education 

Interagency and multidiscipline education in the military, federal government, 
homeland security, and the private sector has been beneficial to promoting a collaborative 
capacity. The federal Goldwater-Nichols Act of 1996 (Goldwater-Nichols) recognized 
that the cultural, philosophical, doctrinal, and organizational differences between the 
military branches created problems for their working together (Smith, 2001, p. 38). To 
address these problems, one of the mandates of Goldwater-Nichols was to establish a 
program of joint professional military education (JPME) and temporary joint agency 
assignments for those officers aspiring to upper level management positions (Smith, 
2001, pp. 23-24, 40-41; Yeager, 2008, p. 119). This professional development process 
has produced a cadre of officers with solid cross-agency relationships and knowledge¬ 
base that promote coordination, cooperation, and an atmosphere of trust and confidence 
(Smith,200l,pp. 39-41). 

In 2009, the Center for Homeland Defense and Security (CHDS) at the Naval 
Postgraduate School (NPS) published the report Education: The Key to Homeland 
Security Leadership. This document addresses why the CHDS was created, who CHDS 
would educate, and what necessary educational skills CHDS would cultivate. The CHDS 
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was created in 2002 to design an educational program to fill gaps in problem-solving and 
interagency coordination and cooperation by educating professionals in homeland 
security disciplines to better fulfill their missions of prevention of, protection against, and 
response to, and recovery from terrorist attacks (Center for Homeland Defense and 
Security [CHDS), 2009), p. 7-8, 11). Through education and research, the CHDS 
master’s degree program has spawned a core of homeland security professionals (CHDS, 
2009, p. 41) who use critical thinking and problem-solving skills to work in a complex 
and abstract environment (CHDS, 2009, pp. 8-9). 

Bellavita and Gordon, CHDS master’s program instructors, provided additional 
insight into the program in their 2006 article in Homeland Security Affairs. The CHDS 
program has the goal of expanding the participants’ homeland security context and 
changing how they think, analyze, and communicate about homeland security issues 
(Bellavita & Gordon, 2006, p. 5). Moreover, they gain perspectives apart from their own 
disciplines in which they recognize that all the various disciplines involved in homeland 
security fit into a mosaic of interagency collaboration in which each piece contributes to 
the whole (Bellavita & Gordon, 2006, p. 15). The CHDS hoped to increase its students’ 
knowledge base in 12 core areas, one of which addresses the leadership challenges of 
working in dynamic, interagency, multidisciplinary, and collaborative environments 
(Bellavita & Gordon, 2006, pp. 5-6). Research in homeland security has consistently 
demonstrated that “effective collaboration is the foundation of success” (Bellavita & 
Gordon, 2006, p. 12), and that collaborative leadership requires cultivating the skills 
necessary to be a leader in networks (p. 7), where command and control is a less effective 
leadership style, (p. 11). 

In the field of health care, the United Kingdom recognized that collaboration and 
teamwork between health care providers was necessary to successfully integrate services 
when it initiated its program of community health care (Bligh & Parsell, 1998, p. 526). 
To be successful, health care practitioners needed to be adaptable, flexible, and 
collaborative team players with significant interpersonal skills (Bligh & Parsell, 1998, p. 
526). One of the ways this capability was formed was through shared learning initiatives 
that fostered the growth of an interdisciplinary base of knowledge, teamwork, and a big- 
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picture understanding of the roles and responsibilities of various professions involved in 
the initiative (Bligh & Parsell, 1998, p. 526). This process produced the collateral 
benefits of changed attitudes, improved relationships, increased trust, and reduced 
stereotyping (Bligh & Parsell, 1998, p. 526). 

3. Exercises 

Presidential Policy Directive 8 provides the underlying basis for using 
capabilities-based planning to prepare for the homeland security mission of prevention, 
protection, mitigation, response, and recovery (White House, 2011, p. 1). The DHS 
Homeland Security Exercise and Evaluation Program (HSEEP) is a capabilities and 
perfonnance based exercise program that furnishes a national standard for the design, 
development, conduct, evaluation, and improvement planning for exercises (DHS, 2007, 
p. 1). HSEEP does not tell agencies or jurisdictions what to exercise but rather how to 
exercise. The purpose of exercises is to assess preparedness in a reduced-risk setting (p. 
1). Exercises can help evaluate the degree to which capabilities have been improved by 
testing and validating MOUs, MAAs, plans, policies, procedures, training, equipment, 
and technology (DHS, 2007, p. 1). Exercises can also improve collaboration, refine roles 
and responsibilities, and identify areas for improvement (DHS, 2007, p. 1). HSEEP 
enumerates the elements necessary for an effective Exercise Program Management plan 
to sustain a multifaceted exercise plan over an extended period of time—such as 
planning, project management, grants, financial management, and staffing (DHS, 2007, 
p. 3). The dominant feature of HSEEP program management is the multi-year exercise 
plan (DHS, 2007, p. 3). The exercise plan is produced as a result of a Training and 
Exercise Workshop in which stakeholders identify priority capabilities that need building 
(p. 3). Stakeholders then plan a variety of exercises (e.g., tabletop, functional, full-scale) 
to assess the progress of improving those capabilities over several years (DHS, 2007, p. 
3). Therefore, HSEEP is another example of a structure that supports a collaboration 
effort. 

The current trend in some businesses and governments to work within a 
networked and collaborative environment is a good example for those who may be 
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involved in regional LE investigations. When multiple law enforcement agencies band 
together in joint investigations, they do not fuse into one unified agency but rather 
maintain their distinctiveness as organizations. Incorporating other disciplines into the 
investigation (e.g., fire/EMS, public information, and fusion centers) creates even more 
complexity. Research and experience have demonstrated that the weaving together of the 
right leadership, technology, and structural support can build the collaborative capacity 
and operational teamwork necessary for intergovernmental, interagency, and 
multidisciplinary groups to work in successful partnerships. 

The next chapter will examine what subject matter experts from the NCR’s law 
enforcement, fire/EMS, public infonnation, and fusion center disciplines view as 
principal factors in facilitating a collaborative effort in conducting effective and efficient 
regional investigations. 
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VI. WHAT DOES THE NCR SAY? 


Previous chapters have discussed how research and experience have expanded 
insights into how to conduct a successful regional investigation by 1) examining lessons- 
leamed from the DC Sniper case; 2) incorporating accepted incident management 
models; and 3) promoting those things that foster collaboration while avoiding those 
things that hinder collaboration. 

A. THE DELPHI SURVEY 

To determine how NCR regional partners would answer the research questions 
posited in Chapter I, 19 subject matter experts (SMEs) from the NCR disciplines of law 
enforcement, fire/EMS, public information, and fusion centers were interviewed for this 
research using the Delphi research method. Since these SMEs are from agencies that 
would be operating within the framework of a regional investigative framework, it is 
important that they had input into the development of the plan. This group of SMEs will 
be identified in the remaining chapters as the Delphi panel. For more infonnation about 
the Delphi survey method and the research subjects who participated in the interviews, 
see Chapter I. 

For the first round of interviews, the Delphi panel members were interviewed at 
their place of employment or home using a standard questionnaire that had been emailed 
to them several days prior to the interview (see the appendix). The interviews were audio 
recorded and ranged in length between 1-2.5 hours each. Afterwards, typed notes of the 
interviews were completed based upon the audio recordings. 

For analysis, the responses from the first round of interviews were listed in a 
Word table, with very similar responses grouped into a single response. This yielded 189 
responses that were then sorted into seven primary themes: 

• Factors that foster collaboration (42 responses) 

• Factors that hinder collaboration (26 responses) 

• Incident management (24 responses) 

• Joint operations centers vs. network-of-command-posts (53 responses) 
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• Training and exercises (15 responses) 

• Integrating other disciplines into regional investigations (24 responses) 

• Law enforcement culture (5 responses) 

In the table, the general level of agreement among the SMEs was noted next to 
each response by listing the number of times a similar comment was made by the SMEs 
(e.g., one SME, some SMEs, many SMEs, most SMEs, and all SMEs). Because the 
SMEs were in such close agreement on the paramount themes of the research after the 
first interview, it was apparent that a second round of interviews would complete the 
Delphi process. 

In preparation for the second round of interviews, the response tables were 
emailed to the SMEs with the request to review each of the 189 comments and determine 
if they “agree,” “disagree,” or were “undecided,” about the comment. All but one SME 
was available for the second round of interviews that were conducted by phone. The 
SMEs identified those responses listed in the table for which they either disagreed or 
were undecided about. Since the SMEs indicated that they agreed with the other 
remaining responses, the other responses were not discussed in the second round of 
interviews. Since most of the SMEs had questions about the context of some of the other 
SMEs’ responses, that contextual information was provided to them. The SMEs advised 
that that helped them make clearer decisions about their level of agreement with those 
responses. 

To analyze the second round of interviews, the SMEs’ decisions (agree, disagree, 
undecided) about each of the 189 responses listed in the Word table from the first round 
of interviews were computed. To detennine the level of consensus for each response, the 
results were tallied to identify the number of “agree,” “disagree,” or “undecided” 
responses for each of the 189 statements in the table. 

A third round of interviews was not necessary because a consensus on the primary 
issues had been achieved by the end of the first round of interviews, while the second 
round provided some additional insight into the predominant themes. Of the 189 
responses from the first round of interviews, the majority of SMEs disagreed with only 

one of the responses. About one third of the SMEs were in disagreement or were 
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undecided about only a handful of other responses, while the vast majority of SMEs 
agreed with all the other responses listed in the Word table. Within the central themes of 
the SMEs’ responses, there was almost unanimous consensus about some of the weightier 
issues. 

B. FACTORS THAT FOSTER COLLABORATION 

All SMEs identified prior-established-relationships, regular communication, and 
information-sharing as vital to a collaborative relationship. In addition, MOUs were 
recognized as important for some working relationships to clarify roles, responsibilities, 
expectations, capabilities, and operational issues, among other things. The Delphi panel 
was in strong agreement that leaders need to lead by example and stress to their staff to 
do those things that foster a collaborative relationship (e.g., being transparent in their 
decisions, emphasize focusing on the mission, committing the appropriate level of 
resources, sharing information, checking egos at the door, and designating one agency as 
the lead agency for the investigation). 

C. FACTORS THAT HINDER COLLABORATION 

The SMEs agreed that it takes work to collaborate and that by neglecting to do the 
things that promote collaboration, the level of teamwork will be lessened. They identified 
factors that can sour interagency relationships as not sharing information, excessive 
personal or agency egos, a lack of integrity, and backbiting. They identified leadership 
behaviors that can hann relationships as leaders, who engage in political posturing, are 
media or glory-hounds, do not respect partners, and do not give credit to assisting 
agencies. A lack of technology to nurture communication and data-sharing can also 
negatively influence collaboration. 

D. INCIDENT MANAGEMENT 

Almost all of the SMEs have taken Incident Command System (ICS) training; 
however, most local law enforcement SMEs do not use it frequently in their duties. The 
SMEs recognized the need for a system to manage regional investigation and made 
recommendations for how unified command and a governing body should be established. 
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Almost all of the SMEs were unfamiliar with the incident management system in the 
United Kingdom kn own as the “Gold-Silver-Bronze.” After being provided an 
explanation of the system, the law enforcement SMEs were in agreement that the Gold 
level function would be a good idea to incorporate into an NCR ICS-based regional 
investigative management model. The Gold level, similar to the NEVIS’ MAC Group, is a 
cadre of senior representatives from each of the agencies providing essential resources to 
the investigation who would provide oversight and governance for unified command 
managing the investigation. None of the SMEs volunteered that they were familiar with 
the ICS concept called a “MAC Group.” 

The law enforcement Delphi panel SMEs were in agreement on the appropriate 
level of rank for officers serving within unified command and the MAC Group / Gold 
level. Unified command should be staffed by investigative section managers (e.g., the 
Homicide Commander, the Crimes-Against-Persons Commander). In addition, the MAC 
Group / Gold level should be staffed by an officer just below the level of police chief 
(e.g., a deputy chief, assistant chief, or chief of detectives). 

None of the law enforcement SMEs thought that there was a need to have 
common investigative protocols for local law enforcement agencies working in a regional 
investigation since each law enforcement agency has been successful in using its own 
protocols. Furthermore, the SMEs recognized that it would be impracticable, and 
virtually impossible, for the large number of NCR jurisdictions from two states and the 
District of Columbia to agree upon and maintain a common set of investigative protocols. 

The two FBI SMEs clarified the roles of local LE and the FBI during 

investigations that have a nexus to terrorism and those that do not. For terrorism 

investigations, the FBI is the lead investigative agency while local LE are support 

agencies; whereas, in non-terrorism investigations, local LE agencies are usually the lead 

agencies and the FBI may be a support agency. When the FBI is the lead agency for a 

joint investigation, it will manage the investigation via its Joint Terrorism Task Force 

(JTTF) structure. Under this model, local LE would be asked to augment their staffing 

compliment to the JTTF to support the investigation. At a terrorism crime scene, the FBI 

would be the lead agency and would integrate the initial investigative response within 
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unified command with appropriate local response agencies. Because terrorism cases will 
be prosecuted in federal courts, the investigation will follow FBI protocols, especially the 
paperwork. For those investigations where local LE is the lead investigative agency, the 
FBI can support the investigation with an array of capabilities and would operate within 
the management structure established by the local agencies. 

E. JOINT OPERATIONS CENTER (JOC) VS. A NETWORK OF 

COMMAND POSTS 

For regional investigations, there was great consensus among LE and fusion 
center SMEs that they would prefer to work in a JOC structure rather than in a network of 
command posts. They thought that a JOC would facilitate communication, information¬ 
sharing, and relationship-building better than a network of command posts. Furthermore, 
the law enforcement SMEs believed that a JOC was appropriate for a regional 
investigation of a dynamic and high-impact series of crimes such as the DC Sniper case. 
They agreed that although the FBI could stand up a JOC quickly, local law enforcement 
agencies would have a much harder time standing up a JOC because few agencies have a 
location suitable for a JOC or the finances to support it. Additionally, there may not be 
the political will to finance a JOC unless the nature of the crimes compelled the 
establishment of a JOC. 

The Delphi panel believed that the type and scope of the crimes were crucial 
considerations when deciding between a JOC or network of command-posts structure. 
They recognized that a network of command posts would be more appropriate for a series 
of crimes that were not dynamic or having a high public impact. Command, coordination, 
communication, and data-sharing would be significant challenges for managing an 
investigation in a network of command posts rather than from a single JOC; therefore, 
effective communication and data-sharing technology is vital to the success of a 
networked investigation. Most of the SMEs have used conference calls, but few had the 
capability for video teleconferencing (VTC). In addition, most of the local law 
enforcement SMEs were unaware of the FBI’s Internet-based case management system 
called ORION (Operational Response and Investigative Online Network). The FBI uses 
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this system for managing some of its investigations and has made this technology 
available to local LE through LEO (Law Enforcement Online). 

However, two NCR local law enforcement agencies have experience using 
ORION to manage cases. One jurisdiction used it for a recent regional investigation with 
federal law enforcement, while a homicide squad in another jurisdiction routinely uses 
ORION to manage certain cases. The LE SMEs thought it would be worthwhile for NCR 
investigative units to explore using the ORION technology. Finally, the SMEs recognized 
that the downside of a network investigation would be that it would be more difficult to 
share infonnation, build relationships, and manage the technology training and 
operational issues. 

F. TRAINING AND EXERCISES 

All of the SMEs thought that it is important to conduct training and exercises to 
build interagency and multidisciplinary collaborative capacity. Although exercises are 
another demand on already full schedules, the SMEs were in agreement that exercises are 
part of the job and that personnel need to make the time to participate in exercises that 
can help identify preparedness gaps. 

G. INTEGRATING OTHER DISCIPLINES INTO A REGIONAL 

INVESTIGATION 

All the SMEs recognized the importance of the public information function as a 
significant component of the NIMS model. The fire department SMEs stated that fire 
departments would be very willing to assist LE in a manner consistent with their nonnal 
operations. They would be open to training on how to avoid the unnecessary destruction 
of evidence at crime scenes, and to being extra “eyes and ears” to collect infonnation in 
the community that may be of use to investigators. Fire department personnel have 
experience in managing large incidents using ICS and could provide incident 
management expertise to law enforcement leaders. Fusion centers SMEs advised that 
fusion centers can support regional investigations depending on the seriousness and 
multijurisdictional nature of the crimes. Moreover, fusion centers could provide 
intelligence support, computer background checks on a large number of suspects, 
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information-sharing infrastructure, and dissemination of information to a large number of 
LE agencies. 


H. LAW ENFORCEMENT CULTURE 

Although the LE discipline is fragmented between jurisdictions, there is general 
agreement among the LE SMEs that NCR LE agencies are willing to work with each 
other, despite the lack of respect for other agencies and their functions that sometimes 
exists. Investigators tend to have strong egos, and they want to take ownership of cases 
and bring them to successful resolution. This is normally a good thing; however, 
sometimes, investigators have excessive egos and want to be the “hero,” which can 
inhibit collaboration and information-sharing. Investigators appreciate technology, but 
they often do not like data entry tasks such as entering case file information into a cases 
management system. When using technology, they want to understand its functionality 
and how it can be a benefit to them. 

The input from the 19 Delphi panel members represents a cross section of ideas 
from the NCR law enforcement, fire/EMS, fusion center, and public infonnation 
disciplines. There was a remarkable degree of consensus between agencies and across 
disciplines for how to build a collaborative capacity to utilize a broad range of NCR 
resources to conduct regional investigations. The Delphi panel’s viewpoints on how best 
to collaborate were very much in line with the academic research on collaboration, the 
findings of the PERF report, and the incident management principles espoused by NIMS 
and the Gold-Silver-Bronze models. This chapter has identified some of those areas of 
agreement within seven primary themes. For a more thorough listing of the ideas in 
which there was significant agreement among the Delphi panelists, see the Tables 2 
through 6. 
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Table 2. Things that Foster or Hinder Collaboration 


Delphi Panel Responses - Summary Table 

Things that Foster Collaboration 

Things that Hinder Collaboration 

Relationships 

Not Doing the Things That Foster 

• Establishing prior relationships which 
foster trust, the sharing of information, 
and good working relationships. 

• Working together face-to-face. 

• Identifying roles, responsibilities, and 
expectations of each agency and person. 

Collaboration 

• Need to do those things that foster 
collaboration. Doing nothing will hinder 
collaboration. 

Egos, Personalities, Character 

• Excessive personal egos. 

• Cultural agency egos that make its 
personnel think and act like they are better 
than others. 

• Personality conflicts. 

• Lack of integrity, sloppiness, and 
dereliction of duty. 

• Negative words or actions, unjust 
criticisms, backbiting other agencies and 
commanders. 

Memoranda of Understanding 

• Can help define roles and responsibilities, 
capabilities, expectations, points of 
contact, leadership, logistics, finances, 
and operational issues. 

• Should be worded in cooperative and 
collegial terms, and let the leaders work 
out the specifics at beginning of 
investigation; (several SMEs objected to 
this procedure, stating that MOUs should 
be specific to say something and mean 
something.) 

Communication 

• Sharing information in a timely manner 
within and between agencies. 

• Regular briefings, regularly scheduled 
meetings at all levels—managers, 
supervisors, and investigators. 

• Explaining why actions were taken or 
why decisions were made. 

• Controlling rumors. 

• Using available technology to maintain 
communication. 

Communication 

• Personnel who withhold information from 
other partners. This can be an agency or an 
individual characteristic. 

• A refusal to meet with partners (e.g., 
investigators who refuse to meet with 
prosecutors, other LE partners). 

• Poor documentation can cause loss of 
information in a case. 

• Staff turnover can cause a loss of 
information and situational awareness. 
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Delphi Panel Responses - Summary Table 

Things that Foster Collaboration 

Things that Hinder Collaboration 

Leadership 

• Leaders need to lead by example and set 
the tone for the investigation, e.g. 
“checking egos at door,” information¬ 
sharing, emphasizing teamwork, and 
focusing on the goals of the investigation. 

• Leaders need to agree on common 
mission and goals. 

• Managers and supervisors need to stay 
engaged at their appropriate levels of 
responsibility. 

• Leaders need to make decisions - 
otherwise projects will die on the vine. 

• Leaders need to foster, train, and 
encourage those things that promote 
collaboration, and discourage those 
things that hinder collaboration. 

• Even within unified command, one 
agency needs to take the lead. 

• Leaders who have a track record of 
getting things done. 

• Leaders who demonstrate experience, 
competence, and commitment. 

• Leaders who know the strengths, 
weaknesses, and capabilities of 
themselves, their agencies, and other 
partner agencies. 

• Dedication of appropriate level of 
resources to the mission. 

• Consistent conflict management 
protocols. 

Leadership 

• Leaders who insist upon doing things their 
own way when all other leaders want to go 
in another direction. 

• Special interests that prevent leaders from 
compromising. 

• Paying only lip-service to collaboration. 

• Political posturing. 

• Unqualified leaders. 

• Not establishing clear roles and 
responsibilities. 

• Not sharing credit with other partner 
agencies. 

• Media or glory hounds. 

Aeencv Reputations 

• Bad agency reputations, deserved or 
undeserved. 

• Self-promoting agencies with “media or 
glory hounds.” 

• Lack of respect and trust for other agencies 
and their personnel to do their jobs 
professionally. 

• Some agencies have inferiority complexes 
to other agencies or disciplines—this can 
cause a shut down or lack of information¬ 
sharing. 

Trust 

• Prior relationships. 

• Working together face-to-face and side- 
by-side. 

Misc. 

• Systems that do not support collaboration 
(e.g., an interagency investigation that does 
not have an interoperable data-sharing 
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Delphi Panel Responses - Summary Table 

Things that Foster Collaboration 

Things that Hinder Collaboration 

Misc. 

• It takes time and patience for groups to 
work well together. 

• Having the right personnel in the right 
position. 

• Interdisciplinary ride-along programs. 

system). 

• Media leaks can cause suspicion among 
agencies working together. 
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Table 3. NIMS versus Gold-Silver-Bronze 


Delphi Panel Responses-SummaryTable 

Incident Management Model Incident Management Model 

The U.S. NIMS The UK Gold-Silver-Bronze 


• 18 of the 19 SMEs had taken ICS training; 
however, most do not use it on a regular 
basis. 

• ICS is a “use it or lose it” system. Need to 
maintain competency. 

• All the Fire Department, FBI, & PIO SMEs 
rated their knowledge of ICS as high. 

• Most of the local LE agency SMEs rated 
their knowledge of ICS as limited— 
although most said they had a working 
knowledge of some ICS principles. 

• ICS provides a template or structure for 
collaboration, leadership, identifying roles 
and responsibilities, and the organization of 
resources. 

• Only one local LE SME (Virginia) advises 
that his agency uses ICS routinely and has a 
high level of competency. 

• The two FBI SMEs describe themselves as 
well-versed in ICS. 

• All local LE SMEs think that in a joint 
investigation with unified command, the 
investigative section commanders would be 
the appropriate level for unified incident 
commanders. 

• The FBI does not use ICS in its Joint 
Operations Center or investigative model; 
however, the FBI will integrate into unified 
command when working as a support 
agency with local LE. 

• Specialize units within the FBI WFO have 
been trained in ICS and use it operationally, 
e.g. HazMat, bomb techs, and others. 

• Most FBI investigators are not familiar 
with ICS. 

• By its very placement within the Command 
Staff of ICS, ICS recognizes the 


• Several SMEs had a modest familiarity 
with the UK’s Gold-Silver-Bronze 
incident management model; whereas, the 
others had no familiarity with the model. 

After a basic explanation of the model, with 
an emphasis on the Gold Level, the SMEs 
were asked their opinion of the efficacy of 
using the Gold Level in a 
multijurisdictional investigation. 

• The Gold Level naturally occurs in many 
major investigations—upper level 
management usually gets involved (e.g., 
the DC Sniper investigation). 

• The Gold Level would serve an important 
function in a multijurisdictional 
investigation. 

• Building the Gold Level into the 
management model would be a good thing 
because it prompts agencies to put 
someone in charge of fulfilling that role. 

• Non-LE leaders should be included in the 
Gold Level if they provide significant 
resources to support the investigation. 

• All local LE SMEs thought that for serious 
multijurisdictional investigations, the 
appropriate level for Gold would be the 
rank just below the Chief of Police (e.g. 
Deputy Chief, Chief of Detectives). 

• Gold Level can set the tone for agency 
participation in joint investigations. 

• Gold Level needs to understand its 
function and responsibilities, e.g., 
providing oversight without getting 
involved in the day-to-day decision¬ 
making. 

• Several SMEs thought that the Gold Level 
serves the same function at the Principle 
Federal Officer (PFO) in the federal 
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Delphi Panel Responses - Summary Table 

Incident Management Model 

The U.S. NIMS 

Incident Management Model 

The UK Gold-Silver-Bronze 

importance of the public information 
function. 

• ICS is not a substitute for leadership. 
Leadership + ICS is a recipe for success. 

• One local Fire Department has a yearly 
command competency test for its chief 
officers to ensure they can demonstrate and 
retain their ability to use ICS in a practical 
setting. 

• None of the SME’s proactively expressed 
knowledge of MAC Groups that serve the 
same function as the UK’s Gold level. 

system. 

• Gold Level needs its own level of the PIO 
function because of the political nature of 
that level. 


Table 4. JOC versus Network of Command Posts 


Delphi Panel Responses - Summary Table 

Joint Operations Center (JOC) 

Network of Command Posts 

JOC: A joint operations center is a 
facility that functions as the command 
post for a joint investigation. 

Network: When multiple investigative 

agencies work a joint investigation from their 
own individual agency command post. 

• The preference is to work in a JOC 
rather than a network of command posts. 

• SMEs recognize that a network may be 
more practical for some investigations. 

When to Stand Un a JOC? 

• A JOC is more appropriate for a 
dynamic and high-impact investigation 
(e.g., the DC Sniper investigation). 

• The type and scope of the crimes are a 
key consideration for standing up a JOC. 

When to Use a Network? 

• For joint investigations of crimes that are 
not as dynamic and do not have a high 
public impact, e.g., serial rapes that occur 
infrequently, serial burglaries. 

• The type and scope of the crimes are a key 
consideration. 
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Delphi Panel Responses - Summary Table 

Joint Operations Center (JOC) 

Network of Command Posts 

The JOC is a better venue for 

• Establishing relationships, trust and 
bonding. 

• Sharing information. 

• Generating ideas from a cadre of 
professionals working together. 

• Resolving problems. 

• Communicating. 

Technologv 

• The technology is not available to make a 
network investigation work. 

• The right communication and information¬ 
sharing technology must be present. 

• Need to use technology to bring together 
geographically dispersed jurisdictions. 

• A central case fde repository is necessary. 

• Most SMEs are familiar with conference call 
communication technology. 

• The investigative model should include 
guidelines on the use of technology to 
ensure that proper communication and 
information-sharing occurs. 

• Data entry into a central electronic case file 
will be a significant issue. 

Standing Up a JOC 

• The FBI has several pre-identified NCR 
locations for JOCs that can be set up 
within 12 hours. 

• When necessary for a local LE 
investigation, the NCR police chiefs 
need to take the initiative to set it up and 
staff it. 

• Local NCR LE should have a location 
pre-established for a JOC. Two NCR 
jurisdictions have a facility that could be 
converted into a JOC, if needed. 

• If local LE were to set up a JOC, there 
would be issues about who would pay 
for it. 

Communication 

• There should be regularly scheduled 
conference calls for information and data- 
sharing. 

• The three main things necessary for 
communication to work in a network: 

1) Everyone should have the same 
technology; 2) Common protocols for 
information-sharing; 3) Need to practice 
and exercise on the technology so users 
know how to use it when needed. 

Misc. 

• Prior relationships help a JOC function 
more smoothly. 

• A central location for tip management is 
necessary. 

• It helps to have a direct conduit to cases 
and evidence from other agencies. 

• It helps assemble the strengths and 
capabilities of involved agencies. 
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Delphi Panel Responses - Summary Table 

Joint Operations Center (JOC) 

Network of Command Posts 

Disadvantages of a JOC 

• They cost a lot of money to set up. There 
may not be the political will to so this. 

• Most jurisdictions are not prepared to 
stand up a JOC. 

• If some agencies do not participate in 
the JOC, then there could be a splitting 
of the investigation. 

• Geography could cause problems for 
jurisdictions that are geographically 
removed from the JOC location. (Some 
SMEs voiced that if there is a JOC 
established, then remote agencies need 
to ensure that their personnel staff the 
facility.) 

Efficiency 

• Staff does not waste time in commuting to a 
remote JOC location. 

• Investigators can use their normal work 
stations, technology, support personnel, etc. 

Misc. 

• A history of working well together can make 
a network function well. 

• When working in a network, there is still the 
need for one agency to be the lead agency in 
the investigation. 

• A virtual joint information center (JIC) 
would be the appropriate structure for the 
public information function. 

ORION: Internet-based Case Management 

System 

• FBI uses ORION as their case management 
system. The same system is available for 
use by local LE via Law Enforcement 

Online (LEO). 

• Most local LE agencies are unfamiliar with 
this system. 

• Prince George County’s Homicide Squad 
regularly uses ORION to manage some 
cases. 

• Prince William County PD has used 

ORION for a recent regional investigation. 

• A network investigation is now possible 
that was not possible five years ago. 

• An advantage of an Internet-based case 
management system is that remote viewing 
and data entry can be made for intelligence, 
leads, information, etc. 
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Delphi Panel Responses - Summary Table 

Joint Operations Center (JOC) 

Network of Command Posts 


Disadvantages of a Network 

• If an incident disrupts infrastructure, Internet 
access for ORION may be lost. 

• Only a few law enforcement agencies have 
access to video-teleconferencing technology 
for virtual meetings. 

• Can be harder to establish relationships and 
trust in a network, especially with out of 
state agencies that are not past partners. 

• Some information will be lost in a 
networked investigation. 


Table 5. Training and Exercises 

Delphi Panel Responses - Summary Table 
Training and Exercises 

Exercises: Benefits to Collaboration 

• Builds relationships. 

• Fosters communication. 

• Dispels unrealistic expectations of capabilities of partner agencies. 

• Merely inviting other agencies to training events establishes interagency good will. 

Simulating Reality 

• Tabletop, functional, and full-scale exercises—there are a variety of exercises that can be 
staged for various types of personnel. 

• Exercises should be interagency and multidisciplinary to simulate reality. Agencies 
typically already know how to do perform their function; however, the challenge is to 
integrate the responses of all partners. 

• Can help to identify preparedness gaps. 

Mise. 

• Most SMEs have participated in exercises (e.g., tabletop, functional, full-scale). 

• Police chiefs need to ensure that their personnel participate in exercises. 

• Informational interdisciplinary training bulletins would be helpful for agencies to gain an 
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Delphi Panel Responses - Summary Table 


Training and Exercises 

understanding of other disciplines. 

• Using a system like ORION will require training of all users, and supervisors, and some 
managers. 


Table 6. Law Enforcement Culture 


Delphi Panel Responses - Summary Table 


Law Enforcement Culture 


• Although the LE discipline is very fragmented between jurisdictions and levels of 
government, there is a general sense that LE in the NCR are willing to work together 
closely on regional investigations. 

• Sometimes there is a lack of respect for other agencies and their functions (e.g., rifts 
between federal and local LE, or between patrol and investigators). 

• Investigators tend to have strong egos which inspire them to take ownership of cases and 
bring them to successful conclusions. 

• Sometimes, investigators have excessive egos and want to be the “hero.” Excessive egos 
can inhibit collaboration and information-sharing. 

• Technology: Oftentimes, investigators do not like data entry tasks, such as entering case 
file information into a case management system. 

• Technology: When using technology, LE officers want to understand its functionality and 
how it can be a benefit to them. 


Table 7. Integrating Other Disciplines into a Regional Investigation 

Delphi Panel Responses - Summary Table 
Integrating Other Disciplines Into a Regional Investigation 

Public Information Function 

• This function is recognized as important and integral to law enforcement investigations, and 
that it is part of the ICS model. 

• Common messaging is important. 

• Most SMEs were unaware of the function of the Joint Information Center within ICS. 

• The NCR has a very active Regional Emergency Support Function #15, Public Information. 


82 












Delphi Panel Responses - Summary Table 
Integrating Other Disciplines Into a Regional Investigation 

Fire Departments 

• The fire/EMS discipline wants to support LE in regional investigations. 

• FDs are willing to act as eye and ears for intelligence purposes. 

• FDs have experience in managing large-scale incidents and can provide that expertise to 
LE. 

• FDs have gear, tools, and resources that other agencies do not have. 

Fusion Centers 

• Three fusion centers serve the NCR and have a good working relationship with each other. 

• Can assist in regional investigations depending on the type and scope of the crime problem 
(e.g., serious crimes that span multiple jurisdictions). 

• Can provide information-sharing infrastructure for investigators (e.g., license plate reader 
program in Maryland, D.C., and Virginia). 

• Can develop leads for investigators and support intelligence functions. 

• Have many contacts that may be able to assist in LE investigations. 

• Can run computer background checks for investigations that have many possible suspects. 

• Can quickly disseminate information to other LE agencies. 

• Can condense a large amount of information into executive summaries. 
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VII. CONCLUSIONS 


Previous chapters provided data concerning the current state of affairs in the 
NCR, lessons-leamed from the DC Sniper case, management techniques provided by the 
incident management models, academic research on collaboration, and the viewpoints of 
the Delphi panel. Since each piece of data in this paper is like a piece in a mosaic, this 
chapter will attempt to synthesize all the data into a congruent whole that creates an 
accurate picture of the NCR’s preparedness to conduct an integrated intergovernmental, 
interagency, and multidisciplinary investigative response to a critical series of crimes 
spanning multiple NCR jurisdictions. 

The NCR local law enforcement agencies currently do not have a framework for 
managing the investigation of a pattern of serious crimes spanning multiple NCR 
jurisdictions. Like other large metropolitan areas, the NCR has experienced felony 
pattern crimes, as well as the DC Sniper attacks in 2002, and is a prime target for 
terrorism attacks. Yet, local law enforcement agencies are fragmented by 18 
jurisdictional boundaries, while federal law enforcement is divided by field offices that 
split responsibilities within the NCR. Other disciplines such as the fire/EMS, fusion 
centers, and public information are also fragmented by local jurisdictional boundaries. 

A. COLLABORATIVE CAPACITY 

Despite the inherently fragmented nature of the NCR’s multijurisdictional 
landscape, the NCR has the collaborative capacity necessary to craft a local law 
enforcement model to manage a regional investigation. The Metropolitan Washington 
Council of Governments, the NCR, and the Department of Homeland Security support 
regional planning, committees, and other structures that foster regional collaboration and 
preparedness activities. The National Preparedness Goal, the National Response 
Framework, the National Incident Management System (NIMS), the Homeland Security 
Exercise and Evaluation Program all support collaboration to build capabilities necessary 
for homeland security missions. 
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The NCR Homeland Security Strategic Plan 2010 has priority goals that promote 
planning, interoperable communication, and data-sharing. The PERF report on the DC 
Sniper case also makes recommendations consistent with the themes of preplanning, 
collaborative decision making, interoperable communication, and infonnation-sharing 
(Murphy & Wexler, 2004). Jointly, all of these documents encourage the enhancement of 
planning, incident management, interoperable communication, and data-sharing 
capabilities which are necessary for creating an investigative framework to manage a 
regional investigation. The groundwork certainly exists to facilitate the NCR’s 18 
independent jurisdictions functioning as one team. 

B. THINGS THAT FOSTER OR HINDER COLLABORATION 

The factors that foster collaboration can be grouped into three basic categories: 1) 
leadership; 2) technology; and 3) institutional or structural features. The PERF report, the 
Delphi panel, and the academic research on collaboration are consistent in identifying 
those factors that promote or hinder collaboration. There is a need to establish 
intergovernmental and interagency relationships prior to an incident that can help fonn 
the basis for trust, respect, social capital, consensus-building, and an appreciation for the 
capabilities of other agencies. Technology must be available to all partners to support 
interoperable communication and data-sharing. In addition, the institutional structures, as 
seen prominently in the NCR, must be there to support a collaborative effort. Policies, 
procedures, models, MOUs, strategic plans, education, training, exercises, and funding, 
all contribute to the institutional and structural commitment necessary for agencies to 
work together. Collaboration does not just happen—it requires leaders and personnel at 
all levels to do the things necessary to make collaboration happen. Not doing those 
necessary things can hinder collaboration. Some of the principal factors that hamper 
collaboration are a lack of communication, the withholding of information, excessive 
egos, and the lack of systems that support collaboration. 

Creating MOUs prior to incidents can help define relationships, roles, 
responsibilities, and how agencies will work together; however, there was some 
disagreement among the Delphi panel members about whether an investigative MOU 
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should list the specifics of the working relationships or be more flexible to allow 
leadership to work out the details at the beginning of a joint investigation. While a formal 
investigative MOU may be difficult to negotiate and maintain between the 18 NCR 
jurisdictions and the federal law enforcement agencies, the COG’s Police Chiefs 
Committee (R-ESF #13) could adopt an investigative framework for the joint 
investigation of regional pattern crimes. The unified support for this model from the 
Police Chiefs Committee would provide a strong basis for collaboration, while giving 
local and federal law enforcement agencies some flexibility working within its 
guidelines. 

C. INCIDENT MANAGEMENT 

1. FBI versus Local Law Enforcement as the Lead 

The National Response Framework designates the FBI as the lead agency for 
terrorism investigations, while other federal laws give the FBI primary jurisdiction over 
other types of crimes, some of which have an interstate nexus (U.S. Government, 2013). 
There is a difference between joint investigations in which the FBI is the lead agency and 
when the FBI is a support agency. When the FBI is the lead agency, there is little need for 
local law enforcement to have an investigative framework in place. If local law 
enforcement supports a federal investigation, it will integrate into the federal 
investigative management model. In those investigations where local law enforcement 
agencies are the lead for the investigation, the FBI can contribute an array of resources to 
support the investigation without taking over command of the investigation. In those 
cases, it is incumbent upon local law enforcement to have an investigative management 
model ready to integrate the participation of multiple agencies, levels of government, and 
disciplines to ensure an effective and efficient investigation. 

2. NIMS 

Part of the national support structure for collaboration is the National Incident 

Management System, a nationally mandated and standardized incident management 

model for integrating response operations from various levels of governments, agencies, 

and disciplines. It promotes sound management principles, including unified command, 
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which fosters consensus-building in the decision-making process. The PERF report on 
the DC Sniper case investigation, the NCR Regional Emergency Coordination Plan, and 
the COG Police Chiefs Committee’s Mutual Aid Operations Plan designate NIMS as the 
model for managing multiple law enforcement agencies in an investigative or operational 
response. 

All of the local law enforcement Delphi panel members have some familiarity 
with ICS, but most of them do not have a sufficient knowledge to construct a detailed 
plan for a multijurisdictional investigation. The author is a state-certified ICS instructor 
and has taught ICS-300/400 to hundreds of trainees. He is familiar with the difficulty that 
many trainees have with learning this system and retaining its principles. With its 
structures and substructures, ICS provides a high level of functionality as a planning and 
management tool; however, ICS requires lot of training and practical use before it can be 
fully understood and used to its functional capacity. 

Many Delphi panelist described ICS as a use-it-or-lose-it system, meaning that in 
order to retain knowledge of the ICS management precepts, ICS must be used in a real- 
world environment on a regular basis. Personnel who perform functions on a lower 
operational level normally do not need to have extensive ICS training to perform those 
functions within a large-scale operation; however, those at the higher levels and the 
planners need to have a good working knowledge of ICS to utilize its power as a 
management tool. For staff not involved in the planning and management of an operation, 
NIMS can seem confusing or superfluous; therefore, the UK’s Gold-Silver-Bronze 
system may be more intelligible and useful in providing a basic understanding of how 
roles are divided and structured within a large response operation. The Gold-Silver- 
Bronze model does not provide as much functionality as an organizational tool as ICS, 
but it is much simpler to understand since it only distinguishes three basic management 
structures: Gold-Silver-Bronze. 

Although the NCR Homeland Security Strategic Plan 2010 (MWCOG, 2010a; 

MWCOG, 2010b) and the Greater Metropolitan Area Police Mutual Aid Operations 

Plan (MWCOG Police Chiefs Committee, 2012) reference a commitment to using 

NIMS, and specifically ICS and the public information function, neither of these 
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documents mentions MAC Groups—the third element of the NIMS component 
Command and Management. The PERF report (Murphy & Wexler, 2004) recommends 
the establishment of a body of senior officials that is consistent with the MAC Group 
concept, and the equivalent of a MAC Group naturally formed during the DC Sniper 
investigations. However, there does not appear to be a practical recognition among the 
Delphi panelists that this MAC Group oversight and support structure exists within the 
NIMS model. As senior representatives from the participating agencies, a MAC Group 
can support unified command by performing a function similar to what a memorandum 
of understanding (MOU) does (e.g., committing resources and funds, coordinating 
decision-making and policies, establishing priorities, and providing guidance and 
direction). While the Delphi panelists presented no familiarity with the MAC Group 
terminology within NIMS, they recognized the need for strategic oversight of a large- 
scale investigation—the purpose of a MAC Group. The Gold-Silver-Bronze incident 
management model of the United Kingdom specifically builds a structure similar to MAC 
Groups (Gold level) into its response operations plans. 

The Delphi panelists agreed that when unified command is established for a 
regional investigation, the appropriate personnel to staff those positions are the section 
commanders of the investigative units involved in the case (e.g., homicide section 
commanders, crimes-against-persons commanders). When a MAC Group or Gold level is 
established, the appropriate personnel to staff those positions are the chiefs-of-detectives 
from the respective agencies. Finally, local law enforcement investigative managers and 
supervisors could benefit from additional training in ICS, public information, and MAC 
Group concepts, with a specific focus on using these elements in managing regional 
investigations. 


3. Case Management System 

The PERF report recommends that an electronic and web-based case management 
system be used to manage the information in a regional investigation and that 
investigators be proficient in using it. The FBI supports such technology in a system 
called ORION, and local law enforcement agencies have access to ORION and its 
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training module on the FBI’s Law Enforcement Online (LEO) secure website. The LEO 
version of ORION has the same functionality as the ORION system used on the FBI 
servers, to which local law enforcement does not have access. ORION is virtually 
unknown to the NCR local law enforcement community; however, it is being used in a 
limited manner by one NCR homicide squad. In addition, ORION appears to be a no-cost 
solution to the problem of maintaining a web-based case management system that can 
support a regional local law enforcement investigation in either the JOC or network of 
command posts management model. Training will be a challenge for developing and 
maintaining competency in this technology. 

4. Joint Operations Center versus a Network of Command Posts 

According to the Delphi panelists, the local law enforcement command post (CP) 
model may be either a joint operations center (JOC) or a network of command posts, 
depending on the type of crimes and the scope of the investigation. Although the tenn 
JOC refers to a specific type of federal facility, the tenn will be used here to refer to a 
generic joint command post. The Delphi panel recognized that there is an inherent 
difference in regional pattern crimes depending on the type of crime and the impact on 
the community and that different management models would be appropriate in different 
circumstances. The JOC model would be more appropriate for series of dynamic crimes 
that have a high impact on the public (e.g., the DC Sniper case), where the need for a 
JOC to help coordinate the investigative response would be more pressing and where 
there would likely be the political will to establish, equip, staff, and fund a JOC. The 
PERF report (Murphy & Wexler, 2004) recommends a JOC for investigations similar to 
the DC Sniper case, as do the Joint Investigations Teams of the European Union, which 
use a JOC structure for multinational criminal investigations. The Delphi panelists had a 
strong preference for working within a JOC structure, rather than a network of command 
posts because they believe that communication, relationship-building, trust, and 
information-sharing would be superior in a JOC setting. 

While local law enforcement agencies do not have experience in setting up, 
managing, and sustaining a JOC, the NCR Type 3 incident management team (IMT) does 
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have the training, experience, and equipment necessary to perform this function. While 
most of the IMT members are not law enforcement personnel, the team has the 
management skills for planning, logistics, financial tracking, etc., to manage a large-scale 
operation. The IMT could manage the non-law enforcement duties of the JOC and could 
serve as SMEs for law enforcement personnel not familiar with NIMS and the operations 
of a large command post. Furthennore, SMEs from local law enforcement could then 
concentrate on the investigation of the case without the distractions of the ancillary duties 
associated with the overall management of a JOC. The cost of deploying the NCR IMT 
would be the responsibility of the agencies requesting its service; however, since most of 
the IMT’s members already serve in the local governments, this cost may be mitigated 
considerably. 

Alternatively, local law enforcement could make a formal request to the FBI to 
support a local investigation by standing up a JOC. The FBI would evaluate the merits of 
this request on a case-by-case basis in making its determination to support the 
investigation in this manner. 

If the NCR decided that the NCR IMT or the FBI would not establish or manage a 
JOC, local law enforcement would require a plan for establishing, equipping, staffing, 
managing, and funding a JOC. 

In less dynamic pattern crimes with a lower impact on the public, a network of 
command posts would be a more practical model because there would probably not be 
the political will to staff and fund a JOC for those types of investigations. In order for an 
investigative network to function well, the Delphi panel acknowledged the need for a 
management support system that addresses the command, coordination, communication, 
and infonnation-sharing needs of the investigation. In a network, ICS and technology 
such as conference calls, video teleconferencing, and a web-based case management 
system such as ORION could support the needs of the investigation. 

Most of the Delphi panel members thought that a joint investigation could be 
managed from a network, but some SMEs were skeptical about the potential of 
technology to maintain connectivity between investigating agencies. The members of the 
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Delphi panel recognized that there would be more communication and coordination 
problems in a network than in a JOC where personnel are collocated. 

Leaders need to recognize the importance of working together as a team in a joint 
investigation, especially a networked investigation. In addition, they need to recognize 
that they will have to work harder at doing those things that promote collaboration and 
prevent those things that hinder collaboration. Successful collaboration requires effort. 
Furthennore, successful networked collaboration requires more effort. 

D. TRAINING, EXERCISES, AND EDUCATION 

Training will be necessary while designing, implementing, and sustaining an NCR 
framework for regional investigations. Because of the novelty of this investigative model, 
there will be new training requirements at all levels of service within the model. Joint 
interagency and multidisciplinary training opportunities will help to break down barriers 
between agencies, improve understanding and relationship-building between the 
agencies, and provide another signal that the region is committed to building its 
collaborative capacity. Exercises that follow the guidelines of the Homeland Security 
Exercise and Evaluation Program (HSEEP) can help to test and validate preparedness by 
identifying gaps in plans, policies, procedures, training, technology, and equipment. 
Exercises are an important part of the preparedness cycle; consequently, agencies should 
treat them as vital to upgrading the NCR levels of investigative preparedness. HSEEP 
provides a professional and standard model for designing, conducting, and evaluating 
exercises. Through the NCR’s Exercise and Training Operations Panel, there is a great 
deal of support for planning, conducting, and evaluating exercises proposed by the NCR 
regional emergency support functions such as the Police Chiefs Committee. 

Joint educational programs like the joint professional military education (JPME) 
and the Naval Postgraduate School’s Center for Defense and Homeland Security master’s 
program can enhance the critical thinking and problem-solving skills necessary to tackle 
homeland security issues in an a complex and networked environment. These programs 
help to build the collaborative capacity of homeland security professionals by exposing 
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them to other disciplines and a range of ideas that form the tapestry of the homeland 
security project. 


E. INTEGRATING OTHER DISCIPLINES 

The PERF report, NIMS, and the Delphi panelists all recognize the importance of 
integrating the public infonnation function into an investigative framework through 
preplanning and training. NIMS has a model for assimilating the unified PIO function 
into incident management via the Joint Infonnation System (JIS) / Joint Information 
Center (JIC). The NCR Emergency Support Function 15 (External Affairs Committee) is 
a very active R-ESF and has adopted the use of the JIC model in its planning and 
operations; therefore, it would be relatively easy to incorporate this function into an NCR 
regional investigative framework. 

Along with the PIO function, there is a role for the fire department and fusion 
center disciplines in some regional investigations. Fire department and law enforcement 
personnel often cross paths when responding to crimes that are part of a regional pattern. 
A broader and more valuable use of the fire department discipline can occur if law 
enforcement considers training opportunities that would help fire/EMS personnel 
understand the needs of law enforcement at crime scenes, or how fire/EMS can provide 
investigative intelligence by serving as extra eyes and ears in the community. 
Furthennore, many fire/EMS chief officers are ICS SMEs and can assist law enforcement 
in establishing an incident management structure and managing a large-scale 
investigation. Additionally, some investigative management responsibilities do not 
require law enforcement expertise, but rather expertise on how to manage tasks and 
resources—a skill possessed by ICS SMEs. 

Depending on the seriousness and scope of a regional investigation, the fusion 
centers can contribute to the investigation. They can conduct computer background 
checks on large numbers of suspects, provide the architecture for managing a large 
amount of infonnation, support the intelligence needs of the investigation in other ways, 
and disseminate FOUO-LES products to a wide LE audience. 
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F. CHALLENGES 

The Delphi panel was very much in agreement about many of the main elements 
that should be in an NCR investigative framework; therefore, much of the plan can be 
developed without having to negotiate differences between jurisdictions. Although a 
substantial collaborative capacity already exists in the NCR, there will be some 
challenges relating to engendering and sustaining collaboration among new partners 
while constructing the regional investigative model. A primary challenge will be 
acquiring the funding to support secure conference call and video teleconferencing 
technology for investigative units throughout the NCR. This technology will have to 
compete with other NCR grant priorities. 

Another challenge will be carving out the necessary time from the already full 
schedules of managers, supervisors, and investigators to work in various workgroups to 
generate a framework for regional investigations. Technology, training, and incident 
management workgroups will be necessary to bring this project to fruition. 

Many of the components necessary for creating this investigative model already 
exist. The underlying rationale for creating a collaborative investigative plan are 
enumerated clearly in documents or research from the federal government, the NCR, and 
academia. The PERF report on the DC Sniper case provides many reasonable 
recommendations based upon lessons-leamed from that investigation. NIMS provides a 
good incident management model for conducting regional operations, whether they are 
law enforcement related or not. In addition, the UK incident management model 
contributes additional insight into how to organize and manage a multiagency 
investigation. The procedures for setting up and staffing a JOC already exist—both at 
the federal level using a non-ICS model, and at the local level by the NCR IMT using the 
ICS model. 

The Delphi panel demonstrated that the NCR recognizes the need to create a 
regional investigative framework and is in agreement about most of the major 
components that should be in the plan. The law enforcement Delphi panel members were 
unanimous in their agreement that there is no need to have common investigative 
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protocols throughout the NCR; however, there is a need to have agreement on how 
multiple law enforcement agencies will work together, communicate, coordinate, and 
share information. 

The NCR has a great collaborative capacity. There are federal and regional 
documents that encourage collaboration, while the Metropolitan Washington Council of 
Governments sustains collaborative efforts in a variety of ways (e.g., support of regional 
emergency support functions, a homeland security strategic plan, grant investments). The 
PERF report on the DC Sniper case and the National Incident Management System 
provide specific guidance on how to manage a regional investigation. The Delphi panel 
demonstrated solid agreement with this guidance, and even provided a nuanced 
contingency in deploying a JOC by leaving open the possibility of managing some 
regional investigations using a network of command posts instead of a JOC. Moreover, 
the panel was in agreement with academic research and the PERF report about those 
factors that tend to promote or hinder collaboration. In addition, the panel was also in 
agreement about the value of leveraging the assets of other disciplines (e.g., fire/EMS, 
fusion centers, and public information, into a law enforcement investigation, training, and 
exercises). Finally, the panel identified certain challenges such as the availability and 
dependency on technology, technology training, and human factors that tend to inhibit 
collaboration. 

Based upon the conclusions enumerated in this chapter, the next chapter proposes 
recommendations to the Metropolitan Washington Council of Governments’ Police 
Chiefs Committee concerning how it can achieve the goal of generating an integrated 
intergovernmental, interagency, and multidiscipline framework for the investigation of 
pattern crimes spanning multiple NCR jurisdictions. 
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VIII. RECOMMENDATIONS 


The recommendations in this chapter are directed towards the NCR’s Police 
Chiefs Committee (Committee), the lead for the regional emergency support function 13 
(R-ESF 13), public safety and security. As the R-ESF 13 lead, the committee sets the 
collaborative goals for the region, supports regional programs, and recommends 
investment priorities for grants. It is only through the support of this committee that the 
recommendations proposed in this paper can come to fruition. 

Recognizing that there is no NCR local law enforcement investigative framework 
in place to conduct regional investigations similar to the DC Sniper case, or even pattern 
crimes of lesser gravity spanning multiple jurisdictions, the committee should consider 
taking proactive actions to support shaping a framework for regional investigative 
solutions. 

A. RECOMMENDATION 1 

To signal its recognition of criminal investigations as an essential component of 
the overall law enforcement mission, the committee should consider incorporating an 
Investigations Subcommittee to oversee the crafting of the guidelines for regional 
investigations and to address other pressing issues relating to investigations. This would 
signal the committee’s strong support of this project that would garner the other support 
necessary to develop the model. The oversight of the Investigations Subcommittee could 
be managed by a small cadre of senior investigative officers (e.g., chiefs of detectives) 
representative of the three main regions of the NCR (Maryland, D.C., and Northern 
Virginia), as well as federal law enforcement (e.g., Assistant Special Agent in Charge) 
for the FBI, and possibly even the ATF. This would have the added benefit of 
establishing intergovernmental and interagency relationships between high-level 
investigative managers. 
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B. RECOMMENDATION 2 

The committee should identify a project manager to work within the 
Investigations Subcommittee to shepherd this project to fruition. The project manager 
should oversee the development of all aspects of the model and should report to the 
subcommittee’s oversight panel. 

C. RECOMMENDATION 3 

The Investigations Subcommittee should be tasked with working out the details of 
creating a flexible and scalable model for managing a regional investigation. 
Membership in the subcommittee should consist of inter-jurisdictional investigative 
managers (e.g., major crimes section commanders), supervisors, and detectives, all of 
whom would have a stake in the model since they would be the ones working within its 
framework. In addition, the subcommittee work teams should be responsible for 
cultivating the capabilities necessary to make a workable investigative model (e.g., 
communication, data-sharing, incident management, and planning). These work teams 
would also help to foster the inter-jurisdictional relationships that are deemed necessary 
for collaboration in a real-world response. 

D. RECOMMENDATION 4 

The Investigations Subcommittee should strongly consider the recommendations 
gleaned from the NCR Delphi panel of SMEs and the Police Executive Research Forum’s 
(PERF) report on the DC Sniper case. The PERF report (Murphy & Wexler, 2004) made 
many recommendations based upon input from key personnel involved in that 
investigation. 

The investigative SMEs on the Delphi panel carefully examined many of the 
issues relating to regional investigations, and were in very close agreement on many 
weightier issues, e.g., incident command; a JOC versus a network of command posts; 
training and exercises; collaborative partnerships; and the incorporation of other 
disciplines into the investigations. Their input and recommendations mirror 
recommendations made by the PERF report, as well as national and regional 
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preparedness documents. Their insights lay a solid foundation for building the 
framework. 

E. RECOMMENDATION 5 

The Investigations Subcommittee should build the regional model for incident 
management using the principles of the National Incident Management System (NIMS). 
NIMS is the national model for incident management and has already been accepted as 
the model for joint law enforcement responses in the NCR. The command and 
management component of NIMS has three elements that can serve as the bases for 
building the NCR model: the incident command system, multiagency coordination 
groups, and public information. These elements would be very useful to the planners for 
establishing the model, but the planners should also consider adopting the UK’s Gold- 
Silver-Bronze verbiage to help those who do not need to know the in-depth details of the 
plan to understand the overall concepts of the plan. Two possible organizational 
structures for incident management are shown in Appendix B. 

F. RECOMMENDATION 6 

The Investigations Subcommittee should consider the merits of using a JOC or a 
network of command posts (network) to manage regional investigations. The two models 
are appropriate for different circumstances, yet the regional investigative model should 
address how each command post style will be used if deployed in an investigation. 
Creating JOC protocols will require a significant level of planning to identify logistical, 
planning, and management requirements. There are several possible options for managing 
a joint-command-post that should be considered (e.g., the JOC could be managed by the 
NCR Incident Management Team, the FBI, local law enforcement agencies, or a 
combination of any of these). 

G. RECOMMENDATION 7 

The Investigations Subcommittee should examine the technology requirements to 
facilitate communication, coordination, and data-sharing for an investigation being 
managed from a JOC or a network of command posts. The Delphi panel and PERF report 
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identified secure audio and video communication and an electronic networked case file as 
necessary for maintaining communication and investigative data. The Delphi panel and 
PERF report also recommend that data-sharing technology be used to maintain a common 
case file. This technology seems to already exist if the fonn of the FBI’s ORION case 
management system available online at no-cost. The subcommittee should enlist the 
assistance of the MWCOG’s regional emergency support function 2 chief information 
officers to assist with identifying technology requirements and solutions. 

H. RECOMMENDATION 8 

The Investigations Subcommittee should address how to leverage the full 
capabilities of non-law enforcement disciplines in the NCR to support a regional 
investigation. The body of this paper discusses ways in which the fire/EMS, fusion 
centers, and public information disciplines can support regional investigations. R-ESF 
#15 (public infonnation), R-ESF 4 (fire/EMS), and the three fusion centers serving the 
NCR should be made part of the planning process so they can develop a stake in the plan 
and clarify how their subject matter expertise, technology, and personnel could be 
maximized to support an investigation. There are other disciplines such as the R-ESF 1 
(transportation), R-ESF 2 (chief infonnation officers), and R-ESF 5 (emergency 
managers) that may also be able to provide helpful insights on how they could support 
investigations. 

I. RECOMMENDATION 9 

The Investigations Subcommittee should produce an education, training, and 
exercise program to help build, maintain, and sustain the capabilities necessary to 
conduct regional investigations. The subcommittee can leverage the assistance of NCR 
resources, such as the Exercise and Training Operations panel (ETOP), to develop a 
multi-year training and exercise plan for this project. Training for fundamental 
components of the framework (e.g., technology, NIMS, federal resources available to 
support local law enforcement, command posts) will be necessary for most managers, 
supervisors, and investigators working within the model. 
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The Police Chiefs Committee should consider sponsoring mid to senior level 
managers to participate in formal education program such as the master’s program or the 
Executive Leaders Program offered by the Naval Postgraduate School’s Center for 
Homeland Defense and Security. These programs emphasize the enhancement of the 
critical thinking, problem-solving, and collaborative skills necessary to boost the 
multidisciplinary collaborative capacity of the NCR to tackle a variety of homeland 
security issues. 

J. RECOMMENDATION 10 

The Police Chiefs Committee should consider this project as a funding priority in 
its recommendations for grant investments. Technology to support secure audio and 
video teleconferencing for investigative units will require some investments. If the 
subcommittee recommends that local law enforcement should develop the capability to 
stand up, equip, staff, and manage a JOC, an investment would be needed to build and 
maintain that capability. 

These recommendations provide for a degree of innovation and differentiation 
that has not been seen in regional local law enforcement investigations in the NCR. The 
creation of a virtual command post by leveraging technology to link multiple command 
posts in different jurisdictions is a way for the NCR to effectively manage some regional 
investigations without the need for standing up an expensive JOC. Interoperable 
communication and data-sharing technology can now facilitate information-sharing, 
communication, and coordination in a way that was not possible in the recent past. The 
incorporation of the MAC Group into the ICS management model promotes a degree of 
senior-level managerial oversight that sometimes naturally occurs in an investigation, but 
it should be planned for. 

Over decades, the National Capital Region has built a collaborative capacity 
across a wide range of homeland security disciplines. These recommendations can 
facilitate the expansion of that capacity so the National Capital Region is prepared to 
effectively and efficiently manage an integrated intergovernmental, interagency, and 
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multidisciplinary investigative response to a critical series of crimes spanning multiple 
jurisdictions. 


102 



APPENDIX. DELPHI PANEL QUESTIONNAIRE 


Background 

1. What is your name? 

2. Do you understand that this interview is being audio recorded? Do you consent to 
this recording? 

3. What agency do you work for? 

4. What is your phone number? 

5. What is your email address? 

6. What is the discipline that you represent? 

Law enforcement 
Fire/EMS 
Public infonnation 
Fusion centers 

7. What is your position within your agency? 

8. What is your title or rank within your agency? 

9. How long have you served in this discipline? 

10. Do you currently serve, or have you recently served, on any boards, regional work 
groups, emergency support functions, emergency operations centers, or other 
collaborative entities within the National Capital Region (NCR) or within your own 
jurisdiction? If yes, please elaborate. 

Collaborative Experience 

11. Have you been involved in any capacity with a law enforcement investigation which 
spanned multiple jurisdictions? If yes, 

Please identify and explain three elements that you believe fostered good 
collaboration. 

Please identify and explain three elements that you believe hindered good 
collaboration. 

12. Have you have been involved in any capacity with any other type of planning, 
project, or incident that required regional or multi-discipline collaboration? If yes, 

Please identify and explain three elements that you believe fostered good 
collaboration. 

Please identify and explain three elements that you believe hindered good 
collaboration. 
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13. Please explain how you view the role of leadership in cultivating and/or hampering 
collaboration. 

14. Please explain what you see as necessary elements to promote personal trust in a 
collaborative environment. 

15. Please explain what you see as barriers to fostering personal trust in a collaborative 
environment. 

16. Are you familiar with the NCR’s Regional Emergency Coordination Plan (RECP)? 

17. Are you familiar with the NCR’s Regional Incident Communications and 
Coordination System (RICCS)? 

Incident Management Principles 

18. Please identify and explain your experiences with any investigations, incidents, or 
events in which the National Incident Management System’s Incident Command 
System (ICS) was used to manage the process. 

19. From your knowledge and experience, please identify what you consider the 
strengths of ICS? 

20. From your knowledge and experience, please identify what you consider the 
weaknesses of ICS? 

21. If you are familiar with the United Kingdom’s incident management model known as 
the “Gold, Silver, and Bronze,” please provide any recommendations about how that 
model can be adapted for use in managing incidents in the NCR? 

22. For regional investigations, would you prefer a centralized command post to manage 
the investigation, or a series of networked decentralized command posts within the 
individual jurisdictions? 

23. Are you aware of an investigative case management system that is, or can be 
networked within the NCR? 

Managing a Multijurisdictional Investigation Involving a Series of 

Related Sexual Assaults & Murders in the NCR. 

24. This question is for Law Enforcement Discipline Only : If this series of crimes were 
to occur in the NCR, are there any regional investigative protocols for fostering a 
collaborative law enforcement investigation spanning multiple NCR jurisdictions? 
For example, are there regional protocols for: 


Command of the multijurisdictional 
investigation 

Determining level of each agency’s 
participation in the investigation 

Roles and responsibilities for each 
agency 


Prioritizing needs of individual 
agencies vs. the task force of 
agencies involved in the 
investigation 

Briefings—frequency, content, 
situational awareness, responsibility 
for conducting 
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Establishing, staffing, and managing 
a joint operations center 

Crime scene management 

Evidence collection, storage, and 
processing 

Managing investigative leads 

Interviews & interrogations 

Charging suspects 

Surveillance operations 

Intelligence collection & sharing 

Communication between 
investigators 

Security of investigative 
communications 

Coordination of tip lines 

Media plan: Release of public 
information/speaking with one voice 

Obtaining legal advice 


Resource management 
Case management 
Autopsy protocols 

Using uninfonned patrol officers to 
enhance the investigation and calm 
public fears 

Using traffic management principles 
and roadblocks for containment or 
movement 

Sustainable alternate shift plans for 
investigators and uniformed officers 

Tactical teams 

Arrest teams 

Ensuring adequate technology 
capabilities to support the 
investigation 

Prosecution task force 

Victim assistance task force 
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25. If these regional protocols do not exist, how would you recommend that they be 
developed for the NCR? 

26. How would you foster communication and coordination within your own discipline? 

27. How would you foster communication and coordination between disciplines? 

28. What can be done within your own discipline (e.g., law enforcement, fire/EMS, 
public infonnation, fusion centers) to promote a collaborative process and improve 
the outcome of a multijurisdictional investigation? 

29. What can be done by the other disciplines (e.g., law enforcement, fire/EMS, public 
information, fusion centers) to promote a collaborative process and improve the 
outcome of a multijurisdictional investigation? 

30. What kinds of technology do you think could benefit a collaborative process (e.g., 
command, control, coordination, communications) in a multijurisdictional 
investigation within the NCR? 

31. Please explain any other challenges that you see in working within your discipline, 
and between disciplines, in managing a multijurisdictional investigation in the 
National Capital Region. 
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Incident Command Organization Chart - Joint Command Post 



ICS-207 


Note: When using ICS, only activate those organizational structures that are necessary for the investigation. 


Table 8. Sample ICS Organization for a Multijurisdictional Investigation: Joint Command 

Post Model 
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Sample Incident Command Chart For a Multi-jurisdictional Investigation - Network of Command Posts Model 

(with MAC Group / Gold Level) 


Q 

_i 

O 

e? 


cc 

LU 

> 


t/» 


Multiagency Coordinating Group (MAC Group) 

(Comprised of Senior Investigative Personnel, 
e.g. Assistant Chiefs from Jurisdictions 1,2,3,4, 5) 




Lines of Communication between 
Unified Command and the MAC Group % 


V\ 


Jurisdictional Incident Commanders in Unified Command 




Fusion Center 
Intel 


Crime Analyst 
Intel 


Flre/EMS 

Intel 


Fusion Center 

Intel 


Fusion Center 

Intel 

Crime Analyst 1 
Intel P 

Flre/EMS 1 

Intel | 


Crime Analyst 
Intel 

Flre/EMS 

Intel 


Fusion Center 
Intel 


Crime Analyst 
Intel 


Fire/EMS 

Intel 


Fusion Center 
Intel 


me Analyst 
Intel 


Fire/EMS 

Intel 



i 


This organizational chart shows the general structure for the management of a multi-junsdictional investigation with an emphasis on the MAC Group (Gold Level) and Incident Command I Unified Command (Silver Level). 

The chart includes the three components of the NIMS element 'Command and Management:' 1.) Incident Command System (ICS); 2.) Joint Information System (JIS); and 3.) Multiagency Coordination System (MAC 
Group), The MAC Group (Gotd level) performs an oversight and coordinating role for the investigation and supports Unified Command. Unified Command includes Incident Commanders from agencies affected by the 
crimes and which dedicate a major level of resources to the investigation. The Joint Information Center (JIC) is part of the JIS and is oomprised of Public Information Officers (PIOs) from the involved junsdlctions, 

In addition to Unified Command, several other functions should be organized as unified disciplines, e.g. Public Information, Intelligence. & Prosecution. The organization of the Operations Section will vary depending on 
the needs of the investigation. The Planning, Logistics, and Finance Sections can be added, as needed. 


Table 9. Sample ICS Organization for a Multijurisdictional Investigation: Network of 

Command Post Model 
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